AI-based file maliciousness classification with push explanation

Abstract

Techniques are described herein that enable AI-based maliciousness classification with push explanations. An AI prompt is provided as input to an AI model along with a file, causing the AI model to classify the file into a malicious class or a non-malicious class, and causing the AI model to provide an explanation that describes reasoning used by the AI model to perform the classification. The AI prompt requests the AI model to choose between the malicious class and the non-malicious class, and also requests an explanation. A response to the AI prompt is received from the AI model. The response includes an indication that indicates the selected class into which the AI model classified the file, and the response also includes the explanation. The explanation is stored and / or provided to a user via a user interface, and a security operation is performed with respect to the file.

Description

Background Technology

[0001] Antivirus engines traditionally employ signature-based methods to detect and classify malware. Signature-based methods typically involve continuously scanning files and comparing their heuristic signatures against known malware patterns. However, signature-based methods have limitations. While they perform well in identifying previously encountered malware, they often fail to detect novel malware. This limitation stems from their reliance on exact or heuristic patterns, which can allow current polymorphic and homomorphic malware to evade detection with minor code modifications. Traditional machine learning methods may be able to capture a broader range of polymorphisms within malicious files. However, traditional machine learning methods typically consume significant time in feature extraction, feature selection, model selection, and hyperparameter tuning.

[0002] Deep learning techniques have been employed to improve the accuracy of malware classification. However, deep learning is essentially a black-box solution; it classifies files but provides no further information related to that classification. This lack of relevant information is a drawback compared to techniques utilizing human classification and may hinder its large-scale adoption. Furthermore, security-critical protection scenarios (e.g., government, healthcare, and manufacturing) typically require accountability, often necessitating file classification by human experts. Relying on human experts for file classification is not a scalable strategy and may leave security-critical protection scenarios vulnerable to malicious actors and activities. Summary of the Invention

[0003] It might be desirable to use an artificial intelligence (AI) model to classify files into malicious or non-malicious categories and provide an explanation describing the reasoning used by the AI ​​model to select which category to classify the file into. An AI model is a model that uses artificial intelligence to generate an answer in response to AI prompts (also known as cue words) received by the AI ​​model. An AI model can be a general artificial intelligence (GA) model. A GA model is an AI model configured to perform any task that an animal (e.g., a human) is capable of performing (e.g., an autonomous AI model). In one example implementation, a GA model is capable of performing tasks beyond the capabilities of animals.

[0004] Artificial intelligence is the intelligence of machines (e.g., computing systems) and / or code (e.g., software and / or firmware), not the intelligence of animals (e.g., humans). AI prompts indicate (e.g., specify) a task to be performed by an AI model. Examples of AI prompts include, but are not limited to, zero-shot prompts, one-shot prompts, and few-shot prompts. A zero-shot prompt is a prompt whose processing by the AI ​​model and / or its corresponding contextual information are not included in the AI ​​model's pre-trained knowledge. A one-shot prompt is a prompt that includes a target prompt along with a single example prompt and a single example response to that single example prompt. The example prompt and example response provide guidance on how the AI ​​model is expected to respond to the target prompt. A few-shot prompt is a prompt that includes a target prompt along with multiple example prompts and multiple example responses to the respective example prompts. The example prompts and example responses provide guidance on how the AI ​​model is expected to respond to the target prompt.

[0005] AI prompts can be natural language prompts. Natural language prompts are prompts written in natural language. Natural language is human language that develops through use and repetition. For example, natural language may develop naturally without conscious planning or pre-planning. Examples of natural languages ​​include English, French, Spanish, and Mandarin Chinese.

[0006] By providing explanations of the reasoning behind the classification, AI models enable users to understand the thought processes behind the classification and make more informed decisions. This reasoning is used by the AI ​​model to choose whether to classify a document into a malicious or non-malicious category. Providing this explanation eliminates the need for feature engineering typically performed by domain experts. Avoiding the use of domain experts to classify documents reduces the cost and time spent on document classification. AI models can process unstructured telemetry data related to documents in plain English (e.g., with relatively little preprocessing) and explain the reasoning behind the classification while classifying the documents. Model selection and feature selection can be performed independently without affecting the visibility of the AI ​​model.

[0007] This paper describes various methods for using AI models to perform classification against malicious activity and includes explanations of the reasoning behind the classification. In an example method, an AI prompt word is provided as input to an AI model along with a target file. The AI ​​model then classifies the target file into a malicious or non-malicious category and provides an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The AI ​​prompt word requests the AI ​​model to choose between the malicious and non-malicious categories to which the target file should be classified, and also requests an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The target file includes context about the AI ​​prompt word. A response to the AI ​​prompt word is received from the AI ​​model. The response includes an indication indicating the selected category to which the AI ​​model should classify the target file, and also includes an explanation describing the reasoning used by the AI ​​model to select the selected category to which the target file should be classified. The selected category is either a malicious or non-malicious category. An explanation is stored and / or provided to the user via a user interface, describing the reasoning used by the AI ​​model to select the chosen category to which the target file is classified. At least based on (e.g., in response to or as a result of) instructions, security operations are performed regarding the target file, instructing the AI ​​model to classify the target file into the chosen category.

[0008] The present invention is provided to introduce, in a simplified form, several concepts further described below in the detailed description. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter. Furthermore, it should be noted that the invention is not limited to the specific embodiments described in the detailed description and / or other parts of this document. These embodiments are for illustrative purposes only. Other embodiments will be apparent to those skilled in the art based on the teachings contained herein. Attached Figure Description

[0009] The accompanying drawings, which are incorporated herein and constitute a part of this specification, illustrate embodiments of the invention and, together with this description, further serve to explain the principles involved and to enable those skilled in the art to implement and use the disclosed techniques.

[0010] Figure 1 This is a block diagram of an AI-based example classification and explanation system according to one embodiment.

[0011] Figures 2 to 4 A flowchart is shown, illustrating an example method for performing AI-based file malice classification with inference interpretation, according to various embodiments.

[0012] Figure 5 This is a block diagram of an example computing system according to one embodiment.

[0013] Figure 6 An example computer in which various embodiments can be implemented is shown.

[0014] The features and advantages of the disclosed technology will become more apparent when viewed in conjunction with the accompanying drawings, in which the same reference numerals consistently identify corresponding elements. In the drawings, the same reference numerals generally denote identical, functionally similar, and / or structurally similar elements. The first appearance of an element in the drawing is indicated by the leftmost numeral in the corresponding reference numeral. Detailed Implementation

[0015] I. Example Implementation It is conceivable to use an artificial intelligence (AI) model to classify files into malicious or non-malicious categories, providing an explanation of the reasoning used by the AI ​​model to select which category to classify the file into. An AI model is a model that uses artificial intelligence to generate answers in response to AI prompts (also known as cue words) received by the AI ​​model. An AI model can be a general artificial intelligence (GA) model. A GA model is an AI model configured to perform any task that an animal (e.g., a human) is capable of performing (e.g., an autonomous AI model). In one example implementation, a GA model is capable of performing tasks beyond the capabilities of animals.

[0016] Artificial intelligence is the intelligence of machines (e.g., computing systems) and / or code (e.g., software and / or firmware), not the intelligence of animals (e.g., humans). AI prompts indicate (e.g., specify) a task to be performed by an AI model. Examples of AI prompts include, but are not limited to, zero-shot prompts, one-shot prompts, and few-shot prompts. A zero-shot prompt is a prompt whose processing by the AI ​​model and / or its corresponding contextual information are not included in the AI ​​model's pre-trained knowledge. A one-shot prompt is a prompt that includes a target prompt along with a single example prompt and a single example response to that single example prompt. The example prompt and example response provide guidance on how the AI ​​model is expected to respond to the target prompt. A few-shot prompt is a prompt that includes a target prompt along with multiple example prompts and multiple example responses to the respective example prompts. The example prompts and example responses provide guidance on how the AI ​​model is expected to respond to the target prompt.

[0017] AI prompts can be natural language prompts. Natural language prompts are prompts written in natural language. Natural language is human language that develops through use and repetition. For example, natural language may develop naturally without conscious planning or pre-planning. Examples of natural languages ​​include English, French, Spanish, and Mandarin Chinese.

[0018] By providing explanations of the reasoning behind the classification, AI models enable users to understand the thought processes behind the classification and make more informed decisions. This reasoning is used by the AI ​​model to choose whether to classify a document into a malicious or non-malicious category. Providing this explanation eliminates the need for feature engineering typically performed by domain experts. Avoiding the use of domain experts to classify documents reduces the cost and time spent on document classification. AI models can process unstructured telemetry data related to documents in plain English (e.g., with relatively little preprocessing) and explain the reasoning behind the classification while classifying the documents. Model selection and feature selection can be performed independently without affecting the visibility of the AI ​​model.

[0019] The example embodiments described herein enable the use of an AI model to perform malicious classification and interpret the reasoning behind the classification. In the example method, by providing an AI prompt along with a target file as input to an AI model, the AI ​​model classifies the target file into a malicious or non-malicious category and provides an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The AI ​​prompt requests the AI ​​model to choose between the malicious and non-malicious categories to which the target file should be classified, and also requests an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The target file includes context about the AI ​​prompt. A response to the AI ​​prompt is received from the AI ​​model. The response includes an indication indicating the selected category to which the AI ​​model classifies the target file, and the response also includes an explanation describing the reasoning used by the AI ​​model to select the selected category to which the target file should be classified. The selected category is either a malicious or non-malicious category. An explanation is stored and / or provided to the user via a user interface, describing the reasoning used by the AI ​​model to select the chosen category to which the target file is classified. At least based on (e.g., in response to or as a result of) instructions, security operations are performed regarding the target file, instructing the AI ​​model to classify the target file into the chosen category.

[0020] Compared to conventional techniques for classifying files based on their maliciousness, the example techniques described herein offer several advantages. For instance, the example techniques can use AI to explain why a file is classified as malicious or non-malicious. In this explanation, the AI ​​can interpret whether, how, and / or to what extent each of a file's multiple characteristics (e.g., attributes) supports or opposes classifying the file as malicious or non-malicious. For example, the AI ​​can assign weights to each feature of the file such that the weights are based on the degree to which that feature supports or opposes a particular classification (malicious or non-malicious) of the file.

[0021] AI can calculate an overall confidence level, which is associated with classifying a file as malicious or non-malicious. For example, the overall confidence level can be based at least on the weights assigned to the features of the file. By using AI, the example technique may be able to classify files as malicious or non-malicious more accurately, precisely, and / or reliably than conventional techniques. For example, the example technique can reduce the number of false positives where a non-malicious file is classified as malicious and / or increase the number of true positives where a malicious file is classified as malicious. By using AI, the example technique can explain the reasoning behind classifying a file as malicious or non-malicious more accurately, precisely, and / or reliably than conventional techniques. By providing explanations of why a file is classified as malicious or non-malicious, the example technique can enhance the user experience for information technology (IT) professionals whose task is to manage the security of systems (e.g., computer networks) that encounter files. For example, the explanation can indicate features worthy of further investigation and / or enable IT professionals to make more informed decisions regarding the security of the system. The user experience for IT professionals can be enhanced in other ways, such as by increasing the accuracy, precision, and / or reliability of file classification and / or the explanation of classification reasoning. The example technology can improve the efficiency of IT professionals by reducing the amount of time they would otherwise spend reasoning to determine document categories.

[0022] The example technology can be implemented as a standalone, robust, and scalable feature without requiring extensive data preprocessing or significant modifications to the AI ​​model.

[0023] Example techniques can reduce the time and / or resources (e.g., processor cycles, memory, and network bandwidth) consumed in classifying files for malicious intent and / or inferring whether a file is classified as malicious or non-malicious. For instance, by using AI to classify files and providing inferences that classify them as malicious or non-malicious, the amount of time and resources that would otherwise be consumed in manually performing such tasks (e.g., based on instructions received from human graders) can be avoided. Therefore, using AI enables the automation of classifying files for malicious intent and the inference that identifies that classification. Automating the process of classification and inference can reduce the costs associated with performing such tasks (e.g., by avoiding human graders). By reducing the amount of time and / or resources consumed, the efficiency of the computing system can be improved.

[0024] Figure 1This is a block diagram of an exemplary AI-based classification explanation system 100 according to one embodiment. Generally, the AI-based classification explanation system 100 operates to provide information to a user in response to a request received from a user (e.g., a Hypertext Transfer Protocol (HTTP) request). This information may include documents (web pages, images, audio files, video files, etc.), the output of an executable program, and / or any other suitable type of information. According to the example embodiment described herein, the AI-based classification explanation system 100 uses an AI model to perform classification against malicious intent and provides an explanation of the classification reasoning. The techniques for performing classification against malicious intent and providing explanations of classification reasoning using an AI model will be described in detail below.

[0025] like Figure 1 As shown, the AI-based classification and explanation system 100 includes multiple user devices 102A-102M, a network 104, and multiple servers 106A-106N. Communication between the user devices 102A-102M and the servers 106A-106N is performed via the network 104 using a known network communication protocol. The network 104 can be a wide area network (e.g., the Internet), a local area network (LAN), other types of networks, or a combination thereof.

[0026] User equipment 102A-102M is a computing system capable of communicating with servers 106A-106N. A computing system is a system including at least a portion of a processor system, such that portion of the processor system includes at least one processor capable of manipulating data according to an instruction set. The processor system includes one or more processors, which may be on the same (e.g., a single) device or distributed among multiple (e.g., separate) devices. For example, a computing system may be a computer, a personal digital assistant, etc. User equipment 102A-102M is configured to make requests to servers 106A-106N to request information stored on (or otherwise accessible via) servers 106A-106N. For example, a user may use a client (e.g., a web browser, web crawler, or other type of client) deployed on user equipment 102 to initiate a request to execute a computer program (e.g., an application), the client being owned by or otherwise accessible to the user. According to some example embodiments, user equipment 102A-102M can access a domain (e.g., a website) hosted by servers 106A-106N, enabling user equipment 102A-102M to access information available via the domain. For example, such a domain may include web pages, which may be provided as Hypertext Markup Language (HTML) documents and objects (e.g., files) linked therein.

[0027] Each of the user equipment 102A-102M may include any client-enabled system or device, including but not limited to desktop computers, laptop computers, tablet computers, wearable computers such as smartwatches or head-mounted computers, personal digital assistants, cellular phones, Internet of Things (IoT) devices, etc. It should be understood that any one or more user equipments of the user equipment 102A-102M may communicate with any one or more servers of the servers 106A-106N.

[0028] Servers 106A-106N are computing systems capable of communicating with user devices 102A-102M. Servers 106A-106N are configured to execute computer programs to provide information to users in response to requests received from users. For example, this information may include documents (web pages, images, audio files, video files, etc.), the output of executable programs, or any other suitable type of information. According to some example embodiments, servers 106A-106N are configured to host corresponding websites, making these websites accessible to users of the metadata generation system 100 based on complex expressions.

[0029] An example type of computer program that can be executed by one or more of the servers 106A-106N is an anti-malware program. An anti-malware program is a computer program configured to detect, block, and / or remove malware. It should be understood that an anti-malware program, or at least a portion thereof, can be executed by any one or more user devices 102A-102M. Examples of anti-malware programs include, but are not limited to: Microsoft Defender® programs developed and published by Microsoft Corporation; Norton AntiVirus® programs developed and published by Symantec Corporation; McAfee LiveSafe® programs developed and published by McAfee, Inc.; CrowdStrike Falcon® programs developed and published by CrowdStrike, Inc.; Bitdefender® programs developed and published by Bitdefender IPRManagement Ltd.; and Avast Antivirus™ programs developed and published by Avast Software sro. It should be understood that the example techniques described herein can be implemented using anti-malware programs. For example, a software product (e.g., a subscription service, a non-subscription service, or a combination thereof) may include an anti-malware program, and the software product may be configured to perform the example technologies, but the scope of the example embodiments is not limited thereto.

[0030] Anti-malware programs can be incorporated into cloud computing programs (also known as cloud services). A cloud computing program is a computer program that provides (multiple) hosted services via a network (e.g., network 104). For example, (multiple) hosted services may be hosted by any one or more servers 106A-106N. A cloud computing program enables users (e.g., users located at any of user systems 102A-102M) to access shared resources stored on (multiple) servers or otherwise accessible to the servers via the network.

[0031] Cloud computing applications can provide multiple managed services based on any of a variety of service models, including but not limited to Backend as a Service (BaaS), Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). BaaS enables applications (e.g., software programs) to use backend services (e.g., push notifications, integration with social networks, and cloud storage) provided by a BaaS provider, where these backend services run on cloud infrastructure. SaaS enables users to use applications provided by a SaaS provider, where these applications run on cloud infrastructure. PaaS enables users to develop and run applications on cloud infrastructure using the application development environment (e.g., operating system, programming language execution environment, database) provided by a PaaS provider. IaaS enables users to use the computing infrastructure provided by an IaaS provider (e.g., to support an enterprise). For example, IaaS can provide users with virtualized computing resources that utilize the physical computing resources of an IaaS provider.

[0032] Examples of cloud computing programs include, but are not limited to: the Google Cloud® program developed and distributed by Google Inc.; the Oracle Cloud® program developed and distributed by Oracle Corporation; the Amazon Web Services® program developed and distributed by Amazon.com, Inc.; the Salesforce® program developed and distributed by Salesforce.com, Inc.; the AppSource® program developed and distributed by Microsoft Corporation; the Azure® program developed and distributed by Microsoft Corporation; the GoDaddy® program developed and distributed by GoDaddy.com LLC; and the Rackspace® program developed and distributed by Rackspace US, Inc. It should be understood that the example technologies described herein can be implemented using cloud computing programs. For example, a software product (e.g., a subscription service, a non-subscription service, or a combination thereof) may include a cloud computing program, and the software product may be configured to perform the example technologies, but the scope of the example embodiments is not limited thereto.

[0033] For illustrative purposes, (multiple) first servers 106A are shown as including AI-based classification and interpretation logic 108. The AI-based classification and interpretation logic 108 is configured to use an AI model to perform classification for maliciousness and interpretation of the reasoning behind the classification. In the example implementation, by providing an AI prompt along with a target file as input to the AI ​​model, the AI-based classification and interpretation logic 108 causes the AI ​​model to classify the target file into a malicious or non-malicious category and provides an interpretation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file is classified. The AI ​​prompt request requests the AI ​​model to select between the malicious and non-malicious categories to which the target file is to be classified, and also requests an interpretation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file is to be classified. The target file includes context about the AI ​​prompt. The AI-based classification and interpretation logic 108 receives a response to the AI ​​prompt from the AI ​​model. The response includes an instruction to the AI ​​model classifying the target file into a selected category, and also includes an explanation describing the reasoning used by the AI ​​model to select the selected category to which the target file is classified. The selected category is either a malicious or non-malicious category. AI-based classification explanation logic 108 stores the explanation, the reasoning used by the AI ​​model to select the selected category to which the target file is classified, and / or provides the explanation to the user via a user interface. At least in response to the instruction to classify the target file into a selected category based on the AI ​​model, AI-based classification explanation logic 108 performs security operations regarding the target file.

[0034] The AI-based classification and interpretation logic 108 can be implemented in various ways to perform classification against malicious intent and interpretation of reasoning based on the classification using an AI model, including implementation in hardware, software, firmware, or any combination thereof. For example, the AI-based classification and interpretation logic 108 can be implemented as computer program code configured to be executed by one or more processors. In another example, at least a portion of the AI-based classification and interpretation logic 108 can be implemented as a hardware logic / circuit system. For example, at least a portion of the AI-based classification and interpretation logic 108 can be implemented in a field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), application-specific standard product (ASSP), system-on-a-chip (SoC), complex programmable logic device (CPLD), etc. Each SoC may include an integrated circuit chip that includes a processor (microcontroller, microprocessor, digital signal processor (DSP), etc.), memory, one or more communication interfaces, and / or one or more other circuits and / or embedded firmware to perform its functions.

[0035] It should be understood that the AI-based classification interpretation logic 108 may be (or can be included in) anti-malware programs and / or cloud computing programs, but the scope of the example embodiments is not limited in this respect.

[0036] The AI-based classification interpretation logic 108 is shown as being incorporated into one or more first servers 106A for illustrative purposes and is not intended to be restrictive. It should be understood that the AI-based classification interpretation logic 108 (or any part thereof) may be incorporated into any one or more servers 106A-106N, any one or more user devices 102A-102M, or any combination thereof. For example, the client-side aspect of the AI-based classification interpretation logic 108 may be incorporated into one or more user devices 102A-102M, and the server-side aspect of the AI-based classification interpretation logic 108 may be incorporated into one or more servers 106A-106N.

[0037] Figures 2 to 4 Flowcharts 200, 300, and 400 depict example methods for performing AI-based file malice classification with reasoning interpretation, according to embodiments. For example, flowcharts 200, 300, and 400 can be derived from… Figure 1 The (multiple) first servers 106A shown are executing. For illustrative purposes, regarding... Figure 5 The computing system 500 shown describes flowcharts 200, 300, and 400. Figure 5 This is an example implementation of (multiple) first servers 106A. For example... Figure 5 As shown, the computing system 500 includes AI-based classification and interpretation logic 508 and a storage device 510. The AI-based classification and interpretation logic 508 includes control logic 512, an AI model 514, action logic 516, static example logic 518, and dynamic example logic 520. Action logic 516 includes interpretation logic 522 and security logic 524. Static example logic 518 includes storage logic 526 and classification determination logic 528. Dynamic example logic 520 includes vector generation logic 530, correspondence determination logic 532, and vector selection logic 534. The storage device 510 can be any suitable type of storage component. One type of storage device is a database. For example, the storage device 510 can be a relational database, entity-relational database, object database, object-relational database, Extensible Markup Language (XML) database, etc. For non-limiting illustrative purposes, the storage device 510 is shown storing classification information 550 and historical vectors 552. Based on the discussion of flowcharts 200, 300 and 400, other structural and operational embodiments will be apparent to those skilled in the art.

[0038] like Figure 2 As shown, the method in flowchart 200 begins at step 202. In step 202, by providing an AI prompt along with the target file as input to an AI model, the AI ​​model (e.g., triggered) classifies the target file into a malicious or non-malicious category, and provides an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The AI ​​prompt requests the AI ​​model to choose between the malicious and non-malicious categories to which the target file should be classified, and also requests an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The target file includes context about the AI ​​prompt.

[0039] In the example embodiment, the AI ​​prompt is a natural language prompt. A natural language prompt is a prompt written in natural language. Natural language is a human language that develops through use and repetition. For example, natural language may develop naturally without conscious planning or pre-planning. Examples of natural languages ​​include English, French, Spanish, and Mandarin. On one hand, natural language prompts are generated by users (e.g., humans). On the other hand, natural language prompts are generated by computing systems (e.g., anti-malware programs running on computing systems).

[0040] In the example implementation, control logic 512 provides AI prompt 558 along with contextual information 560 (including target file 536) as input to AI model 514. This causes AI model 514 to classify target file 536 into a malicious or non-malicious category and provide a classification explanation 542. The classification explanation 542 describes the reasoning used by AI model 514 to select the malicious or non-malicious category to which target file 536 should be classified. AI prompt 558 includes a classification request 554 and an explanation request 556. The classification request 554 requests AI model 514 to select between the malicious and non-malicious categories to which target file 536 should be classified. The explanation request 556 requests AI model 514 to provide a classification explanation 542, which describes the reasoning used by AI model 514 to select the malicious or non-malicious category to which target file 536 should be classified. Target file 536 includes context related to AI prompt 558.

[0041] In one example embodiment, control logic 512 performs one or more preprocessing operations on context information 560 (e.g., target file 536) before providing it to AI model 514. Examples of preprocessing operations include, but are not limited to, removing commas, forward slashes, and / or whitespace (e.g., tabs and / or extra spaces) from context information 560.

[0042] In another example embodiment, context information 560 includes information other than target file 536. For example, this information may indicate (e.g., specify) the name of target file 536, the location where target file 536 is downloaded, the process path associated with target file 536, the process command line associated with target file 536, the parent process command line associated with target file 536, the live process name associated with target file 536, the signer who signed target file 536, the publisher who released target file 536, the certificate associated with target file 536, the header bytes(s) and / or trailer bytes(s) associated with target file 536, the behavior associated with target file 536 (e.g., registry behavior or Windows® Event Tracing (ETW) behavior), and / or the type of target file 536. In one example, this information includes a Uniform Resource Identifier (URI) indicating the location where target file 536 is downloaded. In one aspect, the URI is a Uniform Resource Locator (URL) or a Uniform Resource Name (URN). In another example, the process path includes the name of the target file 536 and a hierarchical list of folders containing the target file 536. In yet another example, the process command line includes the process path and parameters preceding the process path in the command line used to initiate execution of the target file 536. In yet another example, the parent process command line indicates (e.g., includes or ) the command used to initiate the parent process associated with the target file 536. In another example, the live process name indicates (e.g., includes or ) the name of the process associated with the target file 536 and currently running live. In yet another example, the file type can be an executable file, a text file, an image file (e.g., a picture file or a video file), a Portable Document Format (PDF) file, or a file associated with a specific computer program (e.g., a Word™ file associated with the Word™ program developed and published by Microsoft Corporation, or an Excel® file associated with the Excel® program developed and published by Microsoft Corporation).

[0043] In yet another example embodiment, control logic 512 causes AI model 514 to analyze (e.g., develop and / or refine) the relationships between AI prompts 558 (including classification requests 554 and explanation requests 556), contextual information 560 (including target file 536), any of the foregoing information, and an understanding of the confidence level of these relationships. For example, control logic 512 may cause AI model 514 to use artificial intelligence to compare the attributes of AI prompts 558 and contextual information 560 (which may include sample AI prompts and sample contextual information) to determine whether target file 536 should be classified into a malicious or non-malicious category, and generate an explanation describing the reasoning used by AI model 514 in selecting the malicious or non-malicious category to which target file 536 should be classified.

[0044] In some example embodiments, AI model 514 includes a neural network that uses artificial intelligence to determine (e.g., predict) the relationship between AI prompt word 558 and context information 560, as well as the confidence level of that relationship. The neural network uses these relationships to determine whether target file 536 will be classified into a malicious or non-malicious category and generates an explanation describing the reasoning used by AI model 514 in choosing to classify target file 536 into either a malicious or non-malicious category. For example, attributes of AI prompt word 558 and context information 560 (and possible example AI prompt words and example context information) can be compared to determine the similarities and differences between these attributes. According to this example, the neural network can use those similarities and differences to determine the selected category (i.e., malicious or non-malicious) to which target file 536 is classified and generates an explanation of the reasoning used in choosing to classify target file 536 into the selected category.

[0045] Examples of neural networks include, but are not limited to, feedforward neural networks and transformer-based neural networks. A feedforward neural network is an artificial neural network in which the connections between units do not form loops. Feedforward neural networks allow data to flow forward (e.g., from input nodes to output nodes), but they do not allow data to flow backward (e.g., from output nodes to input nodes). In an example embodiment, control logic 512 uses a feedforward neural network to train an AI model 514, which is used to determine an AI-based confidence level. Such an AI-based confidence level can be used to determine the probability that an event will occur.

[0046] A transformer-based neural network is a neural network that incorporates a transformer. A transformer is a deep learning model that uses attention to differentially weight the importance of different parts of a sequence of input data (e.g., natural language). Attention is a technique that mimics cognitive attention. Cognitive attention is a behavior and cognitive process that selectively focuses on discrete aspects of information while ignoring other perceptible aspects. Therefore, a transformer uses attention to amplify some parts of the input data while attenuating others. The transformer determines which parts of the input data to amplify and which parts to attenuate based on the context of each part. For example, a transformer can be trained to identify the context of each part using any suitable technique (e.g., gradient descent).

[0047] In an example embodiment, a transformer-based neural network generates a malice classification model (e.g., to classify files for malice) by utilizing information such as AI cue words (e.g., AI cue word 558), contextual information (e.g., contextual information 560), relationships between any of the foregoing information, and AI-based confidence derived therefrom.

[0048] In the example embodiment, AI prompt 558 includes training logic, and AI model 514 includes inference logic. The training logic is configured to train an AI algorithm, and the inference logic uses the AI ​​algorithm to determine (e.g., infer) AI-based confidence. For example, the training logic can provide sample AI prompts and sample context information as input to the AI ​​algorithm to train it. The sample data may be labeled. The AI ​​algorithm can be configured to derive the relationship between features (e.g., AI prompt 558 and context information 560) and the resulting AI-based confidence. The inference logic is configured to utilize the AI ​​algorithm trained by the training logic to determine AI-based confidence when features are provided as input to the algorithm.

[0049] In one example embodiment, AI model 514 is a Large Language Model (LLM). A Large Language Model is an artificial neural network capable of performing Natural Language Processing (NLP) tasks. For example, a Large Language Model can perform NLP tasks using a transformer model. In one aspect, the Large Language Model is trained (e.g., pre-trained) using self-supervised learning and semi-supervised learning. Examples of Large Language Models include, but are not limited to: the GPT-3 and GPT-4 models developed and distributed by OpenAI, Inc.; the LLaMA model developed and distributed by MetaPlatforms, Inc.; and the PaLM model developed and distributed by Google LLC.

[0050] At step 204, a response to the AI ​​prompt is received from the AI ​​model. The response includes an indication of the selected category to which the AI ​​model classifies the target file, and also includes an explanation describing the reasoning used by the AI ​​model in selecting the selected category to which the target file is classified. The selected category is either a malicious or non-malicious category. In an example embodiment, the explanation is written in natural language. According to this embodiment, the explanation is human-readable. In another example embodiment, the explanation indicates multiple attributes of the target file that help the AI ​​model select the selected category to which the target file is classified. In an example implementation, action logic 516 receives a response 538 to the AI ​​prompt 558 from the AI ​​model 514. The response 538 includes a classification indicator 540 and a classification explanation 542. The classification indicator 540 indicates the selected category to which the AI ​​model 514 classifies the target file 536. The classification explanation 542 describes the reasoning used by the AI ​​model 514 in selecting the selected category to which the target file 536 is classified.

[0051] Each of the malicious and non-malicious categories can include any suitable number of subcategories (e.g., 0, 1, 2, 3, 4, or 5). In an example embodiment, the malicious category includes an "active attack" subcategory and a "passive attack" subcategory. According to this embodiment, the AI ​​model can classify a target file into the "active attack" subcategory based on (e.g., at least based on) its association with an active attack. An active attack is a cyberattack in which a target file is used to attempt to alter system resources and / or affect the operation of system resources. A cyberattack is an attempt to gain unauthorized or illegal access to system resources. System resources are physical or virtual components of a system with limited availability. For example, the system can be a computing system or a networked system that includes such a computing system. A networked system is a system connected to a computing system via a network. Further according to this embodiment, the AI ​​model can classify a target file into the "passive attack" subcategory based on its association with a passive attack. A passive attack is a cyberattack in which a target file is used to attempt to obtain or use information from a system without attempting to alter system resources or affect their operation.

[0052] In another example embodiment, the non-malicious category includes a "spam" subcategory and a "clean" subcategory. According to this embodiment, the AI ​​model can determine, based on (e.g., at least based on) that the target file is associated with a spam message (e.g., attached to a spam message), and classify the target file into the "spam" subcategory. A spam message is an unsolicited or unwanted electronic message. For example, such an electronic message could be an email message, an instant messaging (IM) message, or a short message service (SMS) message. Further according to this embodiment, the AI ​​model can determine, based on the AI ​​model, that the target file is not associated with a spam message, and classify the target file into the "clean" subcategory.

[0053] In step 206, an explanation describing the reasoning is provided to the user via a user interface. This reasoning is used by the AI ​​model to select the chosen category to which the target file should be classified. In one example implementation, explanation logic 522 provides a classification explanation 542 to the user via a user interface. This classification explanation 542 describes the reasoning used by the AI ​​model 514 to select the chosen category to which the target file 536 should be classified. It should be understood that it is not necessarily required to provide this explanation to the user. For example, the explanation may be stored (e.g., in storage device 510) without being provided to the user.

[0054] At step 208, a security operation is performed on the target file, at least based on an indication that the AI ​​model has classified the target file into a selected category. In a first example embodiment, performing the security operation in step 208 includes interrupting user access to the target file, at least based on the selected category being a malicious category. In a second example embodiment, performing the security operation in step 208 includes isolating the target file in a sandbox, at least based on the selected category being a malicious category. A sandbox is an area in a storage device (e.g., storage device 510) isolated from other areas in the storage. In one aspect, a sandbox is a virtual container in which untrusted (e.g., malicious or potentially malicious) software programs can be securely executed. According to this aspect, the sandbox is configured to detect when an untrusted software program performs malicious operations in the virtual container. For example, a software program can run in the sandbox without negatively impacting software programs running outside the sandbox and / or without negatively impacting data stored outside the sandbox. In a third example embodiment, performing the security operation in step 208 includes sending an alert to IT professionals, at least based on the selected category being a malicious category, indicating that the target file has been classified as malicious. In the fourth example embodiment, performing a security operation in step 208 includes enabling the user to access the target file, at least based on the fact that the selected category is a non-malicious category. In one example implementation, security logic 524 performs a security operation 562 with respect to the target file 536, at least based on a classification indicator 540, whereby the classification indicator 540 is used to instruct the AI ​​model 514 to classify the target file 536 into the selected category.

[0055] In an example embodiment, having the AI ​​model classify and provide an explanation of the target file in step 202 includes: having the AI ​​model classify the target file, provide an explanation, and provide an indication of confidence level, which is associated with classifying the target file into a malicious or non-malicious category. According to this embodiment, the AI ​​prompt also requests an indication of confidence level, which is associated with classifying the target file into a malicious or non-malicious category. Further according to this embodiment, the response also includes an indication of confidence level, which is associated with classifying the target file into a selected category. For example, control logic 512 may generate context information 560 to include an indication of confidence level other than the target file 536. In one aspect of this embodiment, the method of flowchart 200 further includes providing an indication of confidence level to a user via a user interface, which is associated with classifying the target file into a selected category. For example, explanation logic 522 may provide an indication of confidence level to a user via a user interface (e.g., in addition to classification explanation 542). In another aspect of this embodiment, performing the security operation in step 208 is also based at least on a confidence level associated with classifying the target file into the selected category. For example, security logic 524 may be configured to perform a first security action at least based on a confidence level greater than or equal to a confidence threshold, and security logic 524 may be configured to perform a second security action, different from the first security action, at least based on a confidence level less than the confidence threshold. The confidence threshold can be any suitable value (e.g., 0.7, 0.8, or 0.85).

[0056] In some example embodiments, one or more steps 202, 204, 206, and / or 208 of flowchart 200 may not be performed. Furthermore, steps other than or replacing steps 202, 204, 206, and / or 208 may be performed. For example, in one example embodiment, the method of flowchart 200 further includes storing classification information in a storage device. The classification information includes a reference identifier identifying a reference document, reference content of the reference document, reference AI prompts, and reference responses to the reference AI prompts. The reference AI prompts request an AI model to select between a malicious category and a non-malicious category to which the target document should be classified, and also requests an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target document should be classified. The reference response includes an indication of the reference category to which the reference document is classified, and also includes a reference explanation describing the reference reasoning used to classify the reference document into the reference category. The reference category is either a malicious category or a non-malicious category. In one aspect, the reference document is a predetermined reference document that is determined before determining whether the target document should be classified into a malicious or non-malicious category. On the other hand, the reference file is a static reference file. In yet another aspect, the reference identifier is an encoded version of the reference file. For example, the reference identifier can be generated by encoding the reference file using a secure hash algorithm (SHA). Examples of secure hash algorithms include, but are not limited to, SHA-224, SHA-256, SHA-384, and SHA-512. In the example implementation, storage logic 526 stores classification information 550 in storage device 510. The classification information 550 includes a reference identifier identifying the reference file, reference content of the reference file, reference AI prompts, and reference responses to the reference AI prompts.

[0057] According to this embodiment, the method of flowchart 200 further includes: in response to classification information being stored in a storage device, determining that a target file is to be classified into multiple categories, including malicious and non-malicious categories. In an example implementation, in response to storage logic 526 storing classification information 550 in storage device 510, classification determination logic 528 determines that the target file 536 will be classified into multiple categories including malicious and non-malicious categories. This determination may be made at least based on receiving a human-generated request from a user or a system-generated request (e.g., from an anti-malware program or a computing system running an anti-malware program). According to this specific implementation, classification determination logic 528 generates classification instructions 564, which instruct control logic 512 to cause AI model 514 to classify the target file 536 into multiple categories. Classification instructions 564 may also instruct control logic 512 to cause AI model 514 to provide classification explanations 542. Classification instructions 564 include classification information 550.

[0058] Further according to this embodiment, by providing the AI ​​prompt word along with the target file and classification information to the AI ​​model, the AI ​​model classifies the target file into a malicious or non-malicious category, and provides an explanation for describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. In the example implementation, by providing the AI ​​prompt word 558 along with context information 560 including the target file 536 and classification information 550 to the AI ​​model 514, control logic 512 causes the AI ​​model 514 to classify the target file 536 and provide a classification explanation 542. For example, control logic 512 can cause the AI ​​model 514 to classify the target file 536 into multiple categories (e.g., and generate a classification explanation 542) at least based on a received classification instruction 564. In one aspect of this example, a classification instruction 564 instructing control logic 512 to classify the target file 536 into multiple categories triggers control logic 512 to classify the target file 536 into multiple categories. In another aspect of this example, a classification instruction 564 instructs control logic 512 to provide a classification explanation 542, triggering control logic 514 to cause AI model 514 to provide a classification explanation 542. In yet another aspect, control logic 512 causes AI model 514 to analyze the reference identifier, reference content, reference AI prompts, and reference responses of the reference file, all included in classification information 550, to determine whether target file 536 is classified in a malicious or non-malicious category. In this example, control logic 512 causes AI model 514 to further analyze the identifier of target file 536, the content of target file 536, and AI prompts 558 to make a determination. According to this example, AI model 514 determines the similarities and differences between the reference identifier, reference content, reference AI prompts, reference responses, the identifier of target file 536, the content of target file 536, and AI prompts 558. Further according to this example, AI model 514 determines, at least based on similarities and differences, whether target file 536 will be classified in a malicious or non-malicious category.

[0059] In one aspect of this embodiment, the classification information also includes a confidence indicator that indicates the confidence level associated with classifying the reference document into a malicious or non-malicious category. In the example, the classification information is provided to the AI ​​model based at least on a confidence level greater than or equal to a confidence threshold.

[0060] In another aspect of this embodiment, the classification information further includes a second reference identifier identifying the second reference document, a second reference content of the second reference document, a second reference AI prompt, and a second reference response to the second reference AI prompt. The second reference AI prompt requests the AI ​​model to select between a malicious category and a non-malicious category to which the second reference document is to be classified, and the second reference AI prompt also requests a second reference explanation to describe the second reference reasoning used by the AI ​​model to select the malicious or non-malicious category to which the second reference document is to be classified. According to this aspect, the second reference response includes an indication of the second reference category to which the second reference document is classified, and also includes a second reference explanation to describe the second reference reasoning used to classify the second reference document into the second reference category, which is either a malicious or non-malicious category. In an example of this aspect, the classification information also includes a second confidence indicator indicating a second confidence level associated with the second reference document being classified into a malicious or non-malicious category.

[0061] It should be understood that classification information may include a third reference document, its third reference content, third reference AI prompts, and a third reference identifier for the third reference AI prompts; a fourth reference document, its fourth reference content, fourth reference AI prompts, and a fourth reference identifier for the fourth reference AI prompts, and so on. Each reference document may be a predefined reference document, a static reference document, or other types of reference document. In the example, the classification information also includes a third confidence indicator indicating the third confidence level associated with the classification of the third reference document, a fourth confidence indicator indicating the fourth confidence level associated with the classification of the fourth reference document, and so on.

[0062] In another example embodiment, the method of flowchart 200 further includes Figure 3 One or more steps are shown in flowchart 300. Figure 3 As shown, the method in flowchart 300 begins at step 302. In step 302, a target vector is generated based at least on an identifier that identifies the target file, the content of the target file, and AI prompt words. In an example embodiment, the target vector generated at step 302 includes: (a plurality of) first values, which are numerical representations of (a plurality of) corresponding attributes of the identifier that identifies the target file; (a plurality of) second values, which are numerical representations of (a plurality of) corresponding attributes of the content of the target file; and (a plurality of) third values, which are numerical representations of (a plurality of) corresponding attributes of the AI ​​prompt words. In an example implementation, vector generation logic 530 generates target vector 546 based at least on an identifier that identifies target file 536, the content of target file 536, and AI prompt words 558.

[0063] At step 304, the degree to which the historical vector corresponds to the target vector is determined by comparing the target vector with historical vectors associated with historical files previously classified by the AI ​​model. In one aspect, at least some historical files (e.g., one, two, ..., or all historical files) were classified by the AI ​​model within a specified number of days prior to the current date (e.g., one, two, or three days). By considering historical files classified within the specified number of days prior to the current date, the accuracy, precision, and / or reliability of classifying the target file into a malicious or non-malicious category can be improved without retraining the AI ​​model over the period including the specified number of days prior to the current date. For example, considering these historical files can provide a scalable way to incorporate new information into the AI ​​model's considerations as it is received (e.g., in real-time). The history vector is based at least on an identifier that identifies the history file, the content of the history file, and an AI prompt word. The AI ​​prompt word on which the history vector is based requests the AI ​​model to choose between a malicious category and a non-malicious category to which the history file should be classified, and the AI ​​prompt word on which the history vector is based also requests an explanation used by the AI ​​model to describe the reasoning used to select the malicious or non-malicious category to which the history file should be classified. In one example embodiment, each history vector includes: multiple numerical representations of corresponding attributes of the identifier that identifies the corresponding history file, multiple numerical representations of corresponding attributes of the content of the corresponding history file, and numerical representations of corresponding attributes of the corresponding AI prompt word. In one example implementation, the correspondence determination logic 532 determines the degree to which the history vector 552 associated with the history file previously classified by the AI ​​model 514 corresponds to the target vector 536 by comparing the history vector 552 with the target vector 536. According to this implementation, the correspondence determination logic 532 generates correspondence information 548 indicating the degree to which the history vector 552 corresponds to the target vector 536.

[0064] At step 304, any suitable correspondence determination technique(s) is used to determine the degree to which the historical vectors correspond to the target vector. Examples of correspondence determination techniques include, but are not limited to, cosine similarity, Euclidean distance, and dot product similarity. In a vector ranking example, the historical vectors are ranked using any one or more correspondence determination techniques to provide a ranking of the corresponding historical vectors. The ranking of each historical vector corresponds to the degree to which that historical vector corresponds to the target vector.

[0065] At step 306, a first historical vector is selected from the historical vectors based at least on the degree to which the first historical vector corresponds to the target vector being greater than or equal to a degree threshold. For example, the first historical vector can be selected from the historical vectors at step 306 based at least on the degree to which the first historical vector corresponds to the target vector being greater than the degree to which other historical vectors correspond to the target vector. In the vector sorting example mentioned above regarding step 304, the first historical vector can be selected from the historical vectors at step 306 based at least on the degree to which the sorting of the first historical vector is greater than the sorting of other historical vectors. In the example implementation, the vector selection logic 534 selects the first historical vector from the historical vectors 552 based at least on the degree to which the first historical vector corresponds to the target vector 536 (as indicated by the correspondence information 548) being greater than or equal to a degree threshold 544.

[0066] At step 308, by providing an AI prompt along with the target file and classification information to the AI ​​model, the AI ​​model classifies the target file into a malicious or non-malicious category, and provides an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The classification information includes: a first identifier identifying a first historical file in the history files, the first historical file being associated with a first history vector; first content of the first historical file; a first AI prompt requesting the AI ​​model to select between a malicious and non-malicious category to which the first historical file should be classified, and the first AI prompt also requesting a first explanation describing the first reasoning used by the AI ​​model to select the malicious or non-malicious category to which the first historical file should be classified; and a first response from the AI ​​model to the first AI prompt. The first response includes an instruction instructing the AI ​​model to classify the first historical file into a first category, and also includes a first explanation describing the first reasoning used by the AI ​​model to select the first category to which the first historical file should be classified, wherein the first category is a malicious or non-malicious category. Step 308 may include... Figure 2 In step 202 shown.

[0067] In the example implementation, by providing the AI ​​prompt word 558 along with the target file 536 and classification information 550 to the AI ​​model 514, control logic 512 causes the AI ​​model 514 to classify the target file 536 into a malicious or non-malicious category and provides a classification explanation 542. According to this specific implementation, vector selection logic 534 generates classification information 550 to include a first identifier identifying the first historical file, the first content of the first historical file, the first AI prompt word, and a first response from the AI ​​model 514 to the first AI prompt word. Further according to this implementation, the first response includes an indication to the AI ​​model 514 of the first category to which the first historical file is classified, and also includes a first explanation describing the first reasoning used by the AI ​​model 514 to select the first category to which the first historical file is classified.

[0068] In one aspect of this embodiment, the history vector is also based at least on a confidence level associated with classifying a history file into a malicious or non-malicious category. In an example of this aspect, each history vector includes multiple numerical representations of corresponding attributes of an identifier identifying the corresponding history file, multiple numerical representations of corresponding attributes of the content of the history file, multiple numerical representations of corresponding attributes of a corresponding AI prompt word, and a numerical representation of a confidence level associated with the classification of the corresponding history file. The numerical representation of each confidence level may be equal to the confidence level, or it may be a number associated with a range of values ​​including the confidence level. For example, a first numerical range X1 may be derived from a first inequality 0. X1 10 is defined; the second numerical range X2 can be defined by the second inequality 10. <X2 20 is defined; the third numerical range can be defined by the third inequality 20. <X3 The definition is 30, and so on. If the confidence level is included in the first numerical range, the numerical representation of the confidence level can be set to "10"; if the confidence level is included in the second numerical range, the numerical representation of the confidence level can be set to "20", and so on. In another example of this aspect, a first historical vector is selected from the historical vectors based at least on the fact that the degree to which the first historical vector corresponds to the target vector is greater than or equal to a degree threshold and also based at least on the fact that the first confidence level in the confidence level is greater than or equal to a confidence threshold. The first confidence level is associated with a first classification that categorizes the first historical file into a malicious or non-malicious category. In another example of this aspect, the classification information also includes a first confidence indicator that indicates the first confidence level, which is associated with the first classification of the first historical file.

[0069] In another aspect of this embodiment, the method of flowchart 300 further includes selecting a second historical vector from historical vectors based at least on the degree to which the second historical vector corresponds to the target vector being greater than or equal to a degree threshold. For example, selecting a second historical vector from historical vectors may be based at least on the degree to which the second historical vector corresponds to the target vector being greater than the degree to which other historical vectors besides the first historical vector correspond to the target vector. In an example implementation, vector selection logic 534 selects a second historical vector from historical vectors 552 based at least on the degree to which the second historical vector corresponds to the target vector (as indicated by correspondence information 548) being greater than or equal to a degree threshold 544. According to this aspect, the classification information also includes a second identifier that identifies a second historical file associated with the second historical vector, a second content of the second historical file, a second AI prompt word, and a second response from the AI ​​model to the second AI prompt word. The second AI prompt word requests the AI ​​model to select between a malicious category and a non-malicious category to which the second historical file is to be classified, and the second AI prompt word also requests a second interpretation for describing a second inference, which is used by the AI ​​model to select the malicious category or the non-malicious category to which the second historical file is to be classified. The second response includes an instruction to guide the AI ​​model to classify the second historical document into a second category, and also includes a second explanation describing the second reasoning used by the AI ​​model to select the second category to which the second historical document is classified. The second category is either a malicious category or a non-malicious category.

[0070] In this example, a first response indicates that a first historical file is classified as malicious, and a second response indicates that a second historical file is classified as non-malicious. According to this example, providing the AI ​​prompt along with the target file and classification information to the AI ​​model includes: at least based on the first response indicating that the first historical file is classified as malicious and at least also based on the second response indicating that the second historical file is classified as non-malicious, causing the AI ​​model to process the first historical file before processing the second historical file.

[0071] In another example of this aspect, a first response indicates that a first historical file is classified into a non-malicious category, and a second response indicates that a second historical file is classified into a malicious category. According to this example, providing the AI ​​prompt along with the target file and classification information to the AI ​​model includes: at least based on the first response indicating that the first historical file is classified into a non-malicious category and also at least based on the second response indicating that the second historical file is classified into a malicious category, causing the AI ​​model to process the first historical file before processing the second historical file.

[0072] In yet another example embodiment, the method of flowchart 200 further includes Figure 4 One or more steps are shown in flowchart 400. Figure 4As shown, the method in flowchart 400 begins at step 402. In step 402, a target vector is generated based at least on an identifier that identifies the target file, the content of the target file, and AI prompt words. In the example implementation, vector generation logic 530 generates target vector 546 based at least on an identifier that identifies target file 536, the content of target file 536, and AI prompt words 558.

[0073] At step 404, the degree to which the historical vector corresponds to the target vector is determined by comparing the target vector and the historical vector associated with the historical file, which was previously classified by the AI ​​model. The historical vector is based at least on: an identifier that identifies the historical file; the content of the historical file; and an AI prompt word on which the historical vector is based, requesting the historical file to be classified as malicious, and the AI ​​prompt word on which the historical vector is based also requests an explanation used to describe the reasoning, which is used by the AI ​​model to perform the classification. In the example implementation, the correspondence determination logic 532 determines the degree to which the historical vector 552 corresponds to the target vector 536 by comparing the historical vector 552 associated with the historical file with the target vector 536, which was previously classified by the AI ​​model 514. According to this implementation, the correspondence determination logic 532 generates correspondence information 548, which indicates the degree to which the historical vector 552 corresponds to the target vector 536.

[0074] At step 406, based on at least N first historical vectors and N second historical vectors corresponding to the target vector to a degree threshold greater than or equal to the degree threshold, N first historical vectors and N second historical vectors are selected from the historical vectors to provide 2N sample historical vectors. The N first historical vectors are associated with historical files classified as malicious, and the N second historical vectors are associated with historical files classified as non-malicious. N is a positive integer. In the example implementation, vector selection logic 534 selects N first historical vectors and N second historical vectors from the historical vectors 552 to provide 2N sample historical vectors, based on at least N first historical vectors and N second historical vectors corresponding to the target vector 536 to a degree threshold greater than or equal to the degree threshold.

[0075] At step 408, P sample history vectors are selected from 2N sample history vectors. P is a positive integer less than 2N. For example, P can be represented by the following inequality: P < 2N. In the example embodiment, P = 2N - 1. In the example implementation, vector selection logic 534 selects P sample history vectors from 2N sample history vectors.

[0076] It should be understood that, in alternative embodiments, P can be equal to 2N.

[0077] At step 410, by providing AI prompts along with the target file and classification information to the AI ​​model, the AI ​​model performs a classification of the target file for maliciousness, and provides an explanation describing the reasoning used by the AI ​​model to perform the classification of the target file for maliciousness. The classification information includes P identifiers, each identifying one of P historical files in the history files, each of the P historical files being associated with one of P sample history vectors; the content of the P historical files; P AI prompts; and P responses from the AI ​​model to the P AI prompts. The P AI prompts request the AI ​​model to choose between a malicious category and a non-malicious category to which the P historical files should be classified, and the P AI prompts also request an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the P historical files should be classified. The P responses include indications to instruct the AI ​​model to classify the P historical files into the selected category, and the P responses also include an explanation describing the reasoning used by the AI ​​model to select the selected category to which the P historical files should be classified. Each selected category is either a malicious or non-malicious category. Step 410 may include... Figure 2 In step 202 shown.

[0078] In the example implementation, by providing AI prompts 558 along with target file 536 and classification information 550 to AI model 514, control logic 512 enables AI model 514 to classify target file 536 into a malicious or non-malicious category and provides a classification explanation 542. According to this implementation, vector selection logic 534 generates classification information 550 to include P identifiers identifying P historical files, the content of the P historical files, P AI prompts, and P responses from AI model 514 to the P AI prompts. Further according to this implementation, the P responses include an indication of the selected category and also describe an explanation of the reasoning used by AI model 514 to select the category to which the P historical files are classified.

[0079] It should be understood that the computing system 500 may not include one or more of the following: AI-based classification and interpretation logic 508, storage device 510, control logic 512, AI model 514, action logic 516, static example logic 518, dynamic example logic 520, interpretation logic 522, security logic 524, storage logic 526, classification determination logic 528, vector generation logic 530, correspondence determination logic 532, and / or vector selection logic 534. Furthermore, the computing system 500 may include components other than the AI-based classification and interpretation logic 508, storage device 510, control logic 512, AI model 514, action logic 516, static example logic 518, dynamic example logic 520, interpretation logic 522, security logic 524, storage logic 526, classification determination logic 528, vector generation logic 530, correspondence determination logic 532, and / or vector selection logic 534, or may include components that replace the aforementioned logic.

[0080] Although some operations in the disclosed methods are described in a specific order for ease of presentation, it should be understood that this descriptive approach allows for reordering unless the specific language used herein requires a particular order. For example, operations described sequentially can be reordered or performed in parallel in certain situations. Furthermore, for the sake of simplicity, the accompanying figures may not show the various ways in which the disclosed methods can be combined with other methods.

[0081] The AI-based classification and interpretation logic 108, AI-based classification and interpretation logic 508, storage device 510, control logic 512, AI model 514, action logic 516, static example logic 518, dynamic example logic 520, interpretation logic 522, security logic 524, storage logic 526, classification determination logic 528, vector generation logic 530, correspondence determination logic 532, vector selection logic 534, flowchart 200, flowchart 300 and / or flowchart 400, any one or more of these can be implemented in hardware, software, firmware or any combination thereof.

[0082] For example, any one or more of the following: AI-based classification interpretation logic 108, AI-based classification interpretation logic 508, storage device 510, control logic 512, AI model 514, action logic 516, static example logic 518, dynamic example logic 520, interpretation logic 522, security logic 524, storage logic 526, classification determination logic 528, vector generation logic 530, correspondence determination logic 532, vector selection logic 534, flowchart 200, flowchart 300, and / or flowchart 400 can be at least partially implemented as computer program code configured to be executed by one or more processors.

[0083] In another example, any one or more of the following can be implemented at least partially as hardware logic / circuit: AI-based classification interpretation logic 108, AI-based classification interpretation logic 508, storage device 510, control logic 512, AI model 514, action logic 516, static example logic 518, dynamic example logic 520, interpretation logic 522, security logic 524, storage logic 526, classification determination logic 528, vector generation logic 530, correspondence determination logic 532, vector selection logic 534, flowchart 200, flowchart 300, and / or flowchart 400. Such hardware logic / circuit can include one or more hardware logic components. Examples of hardware logic components include, but are not limited to, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-chips (SoCs), complex programmable logic devices (CPLDs), etc. For example, an SoC can include an integrated circuit chip that includes a processor (e.g., a microcontroller, microprocessor, digital signal processor (DSP), etc.), memory, one or more communication interfaces, and / or other circuitry and / or embedded firmware for performing its functions.

[0084] II. Further discussion of some example embodiments (A1) An example system ( Figure 1 102A-102M; Figure 5 500; Figure 6 ,600) includes processor system ( Figure 6 ,602) and memory ( Figure 6 (604, 608, 610), the memory stores computer-executable instructions. Computer-executable instructions are executed by the processor system to at least ( Figure 2 ,202) AI model ( Figure 5 ,514) will target file ( Figure 5 (536) are classified into malicious or non-malicious categories, and the AI ​​model provides an explanation. Figure 5 ,542), Explaining the reasoning, which is used by the AI ​​model to select whether the target file should be classified as malicious or non-malicious, by using AI prompts ( Figure 5 The AI ​​prompt (558) is provided as input to the AI ​​model along with the target file. The AI ​​prompt requests the AI ​​model to choose between a malicious and a non-malicious category to which the target file should be classified, and also requests an explanation to describe the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The target file includes context about the AI ​​prompt. Computer-executable instructions, also executable by the processor system, can at least receive ( Figure 2 ,204) Responses from AI models to AI prompts ( Figure 5 ,538). The response includes instructions ( Figure 5 The response also includes an explanation describing the reasoning used by the AI ​​model to classify the target file into the selected category. The selected category is either malicious or non-malicious. The computer-executable instructions are also executable by the processor system to provide, at least via a user interface, information to the user. Figure 2 206) Explanation, the explanation describes the reasoning, the reasoning used by the AI ​​model to select the category to which the target file is classified. The computer-executable instructions, also executable by the processor system, are instructions to classify the target file into the selected category based at least on the AI ​​model, and execute ( Figure 2 208) Regarding safe operations on target files ( Figure 5 ,562).

[0085] (A2) In the example system of A1, wherein the computer-executable instructions are executable by the processor system to at least: by providing an AI model with an AI prompt word along with the target file and contextual information about the target file as input, causing the AI ​​model to classify the target file into a malicious or non-malicious category; and wherein the contextual information includes at least one of the following: an indication of the location where the target file is downloaded; the process path associated with the target file; the process command line associated with the target file; the parent process command line associated with the target file; or the real-time process name associated with the target file.

[0086] (A3) In any of the example systems of A1-A2, wherein computer-executable instructions are executable by a processor system to at least: cause the AI ​​model to classify the target file into a malicious or non-malicious category by providing an AI prompt word along with the target file and contextual information about the target file as input; and wherein the contextual information includes at least one of: instructions for instructing a signer to sign the target file; instructions for instructing a publisher to publish the target file; a certificate associated with the target file; at least one of a header byte or a tail byte associated with the target file; or instructions for actions associated with the target file.

[0087] (A4) In any of the example systems in A1-A3, the explanation in the response to the AI ​​prompt indicates multiple attributes of the target file, which help the AI ​​model select the selected category to which the target file is classified.

[0088] (A5) In an example system of any one of A1-A4, wherein computer-executable instructions are executable by a processor system to at least: store classification information in a storage device, wherein the classification information includes: a reference identifier identifying a reference document; reference content of the reference document; a reference AI prompt, the reference AI prompt requesting an AI model to select between a malicious category and a non-malicious category to which the reference document is to be classified, and the reference AI prompt further requesting a reference interpretation for describing the reference reasoning, the reference reasoning being used by the AI ​​model to select the malicious category or the non-malicious category to which the reference document is to be classified; and a reference response to the reference AI prompt, wherein the reference response includes an instruction, the instruction being used for The reference response includes a reference explanation describing the reference reasoning used to classify the reference file into a reference category, where the reference category is a malicious or non-malicious category; in response to classification information being stored in a storage device, it determines that the target file should be classified into multiple categories, including malicious and non-malicious categories; and by providing AI prompts along with the target file and classification information to an AI model, the AI ​​model classifies the target file into a malicious or non-malicious category, and the AI ​​model provides an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified.

[0089] (A6) In any of the example systems in A1-A5, the classification information also includes a confidence indicator that indicates the confidence level, which is associated with classifying the reference document into a malicious or non-malicious category.

[0090] (A7) In an example system of any one of A1-A6, the classification information further includes: a second reference identifier that identifies the second reference document; second reference content of the second reference document; a second reference AI prompt that requests the AI ​​model to select between a malicious category and a non-malicious category to which the second reference document is to be classified, and the second reference AI prompt that also requests a second reference interpretation for describing the second reference reasoning used by the AI ​​model to select the malicious or non-malicious category to which the second reference document is to be classified; and a second reference response to the second reference AI prompt; and wherein the second reference response includes an indication for indicating the second reference category to which the second reference document is classified, and the second reference response further includes a second reference interpretation for describing the second reference reasoning used to classify the second reference document into the second reference category, wherein the second reference category is a malicious or non-malicious category.

[0091] (A8) In an example system of any one of A1-A7, wherein computer-executable instructions are executable by a processor system to at least: generate a target vector based at least on an identifier identifying a target file, the content of the target file, and an AI prompt; determine the degree to which a historical vector corresponds to the target vector by comparing the target vector with historical vectors associated with historical files previously classified by an AI model, wherein the historical vector is based at least on: an identifier identifying a historical file; the content of the historical file; and an AI prompt, the AI ​​prompt requesting the AI ​​model to choose between a malicious category and a non-malicious category to which the historical file is to be classified, and the AI ​​prompt also requests an explanation for describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the historical file is to be classified; select a first historical vector from the historical vectors based at least on the degree to which the first historical vector corresponds to the target vector being greater than or equal to a degree threshold; and cause the AI ​​model to classify the target file into a malicious or non-malicious category by providing the AI ​​prompt along with the target file and classification information. The AI ​​model provides an explanation for describing the reasoning used by the AI ​​model to select a malicious or non-malicious category to which the target file should be classified, wherein the classification information includes: a first identifier that identifies a first historical file in the history files, the first historical file being associated with a first history vector; a first content of the first historical file; a first AI prompt that requests the AI ​​model to select between a malicious and non-malicious category to which the first historical file should be classified, and the first AI prompt also requests a first explanation for describing the first reasoning used by the AI ​​model to select a malicious or non-malicious category to which the first historical file should be classified; and a first response from the AI ​​model to the first AI prompt, wherein the first response includes an instruction that instructs the AI ​​model to classify the first historical file into a first category, and the first response also includes a first explanation for describing the first reasoning used by the AI ​​model to select a first category to which the first historical file should be classified, wherein the first category is a malicious or non-malicious category.

[0092] (A9) In any of the example systems of A1-A8, the history vector is further based on at least a confidence level associated with classifying a history file into a malicious or non-malicious category; and the computer-executable instructions are executable by a processor system to select a first history vector from the history vectors based at least on the degree to which the first history vector corresponds to the target vector being greater than or equal to a degree threshold, and at least on the first confidence level being greater than or equal to a confidence threshold, the first confidence level being associated with a first classification that classifies the first history file into a malicious or non-malicious category.

[0093] (A10) In any of the example systems of A1-A9, the history vector is further based on at least a confidence level that is associated with classifying a history file into a malicious or non-malicious category; and the classification information further includes a first confidence indicator that indicates a first confidence level in the confidence level that is associated with a first classification that classifies a first history file into a malicious or non-malicious category.

[0094] (A11) In an example system of any one of A1-A10, wherein computer-executable instructions are also executable by the processor system to at least: select a second history vector from the history vectors based on at least a degree corresponding to the second history vector and the target vector being greater than or equal to a degree threshold, wherein the classification information further includes: a second identifier identifying a second history file in the history files, the second history file being associated with the second history vector; a second content of the second history file; a second AI prompt word requesting the AI ​​model to select between a malicious category and a non-malicious category to which the second history file is to be classified, and the second AI prompt word also requests a second interpretation for describing a second inference used by the AI ​​model to select the malicious category or the non-malicious category to which the second history file is to be classified; and a second response from the AI ​​model to the second AI prompt word, wherein the second response includes an instruction for instructing the AI ​​model to classify the second history file into a second category, and the second response further includes a second interpretation for describing the second inference used by the AI ​​model to select the second category to which the second history file is classified, wherein the second category is a malicious category or a non-malicious category.

[0095] (A12) In an example system of any one of A1-A11, wherein a first response indicates that a first history file is classified into a malicious category; wherein a second response indicates that a second history file is classified into a non-malicious category; and wherein computer-executable instructions are executable by a processor system to cause an AI model to process the first history file before processing the second history file, based at least on the first response indicating that the first history file is classified into a malicious category and at least also on the second response indicating that the second history file is classified into a non-malicious category.

[0096] (A13) In an example system of any one of A1-A12, wherein a first response indicates that a first history file is classified into a non-malicious category; wherein a second response indicates that a second history file is classified into a malicious category; and wherein computer-executable instructions are executable by a processor system to cause an AI model to process the first history file before processing the second history file, based at least on the first response indicating that the first history file is classified into a non-malicious category and at least also on the second response indicating that the second history file is classified into a malicious category.

[0097] (A14) In the example system of any one of A1-A13, wherein computer-executable instructions are executable by a processor system to at least: generate a target vector based on at least an identifier identifying the target file, the content of the target file, and an AI prompt; determine the degree to which the historical vector corresponds to the target vector by comparing the target vector with historical vectors associated with historical files previously classified by an AI model, wherein the historical vector is based at least on: an identifier identifying the historical file; the content of the historical file; and an AI prompt, the AI ​​prompt requesting the AI ​​model to classify the historical file between a malicious category and a non-malicious category. The selection process involves selecting historical files and requesting explanations for the inference process, which is then used by the AI ​​model to classify them into either a malicious or non-malicious category. At least N first historical vectors and N second historical vectors are selected from the historical vectors to provide 2N sample historical vectors, based on the fact that the degree of correspondence between the target vector and at least N first historical vectors and N second historical vectors is greater than or equal to a degree threshold. The N first historical vectors are associated with historical files classified as malicious, and the N second historical vectors are associated with historical files classified as non-malicious, where N is a positive integer. P sample historical vectors are then selected from these 2N sample historical vectors. This history vector, where P is a positive integer less than 2^N; and by providing AI prompts along with the target file and classification information to the AI ​​model, enabling the AI ​​model to classify the target file into a malicious or non-malicious category, and enabling the AI ​​model to provide an explanation for describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified, wherein the classification information includes: P identifiers, P identifiers identifying P historical files in the history files, P historical files being associated with P sample history vectors; the contents of the P historical files; and P AI prompts, P AI prompts requesting the AI ​​model to classify the target file into a malicious or non-malicious category in the P... The process involves selecting between a malicious and a non-malicious category to which the historical files are to be classified, and requesting an explanation for describing the reasoning used by the AI ​​model to select either a malicious or non-malicious category to which the P historical files are to be classified; and receiving P responses from the AI ​​model to the P AI prompts, wherein each of the P responses includes an instruction to instruct the AI ​​model to classify the P historical files into the selected category, and further includes an explanation for describing the reasoning used by the AI ​​model to select either a malicious or non-malicious category to which the P historical files are to be classified.

[0098] (A15) In an example system of any one of A1-A14, wherein computer-executable instructions are executable by a processor system to at least: cause an AI model to classify a target file, provide an explanation, and provide an indication of a confidence level associated with classifying the target file into a malicious or non-malicious category, wherein an AI prompt further requests an indication of a confidence level associated with classifying the target file into a malicious or non-malicious category, and wherein a response further includes an indication of a confidence level associated with classifying the target file into a selected category; and provides an indication of a confidence level associated with classifying the target file into a selected category to a user via a user interface.

[0099] (B1) An example method is provided by a computing system ( Figure 1 102A-102M; Figure 5 500; Figure 6 ,600) to achieve. The method includes using AI prompts ( Figure 5 ,558) along with the target file are provided as input to the AI ​​model, enabling the AI ​​model ( Figure 5 ,514) Execute on the target file ( Figure 5 (536) categorizes malicious intent and enables AI models to provide explanations ( Figure 5 (542), explaining the reasoning used by the AI ​​model to perform classification. The AI ​​prompts request classification of the target file and also request explanations. The target file includes context about the AI ​​prompts. The method also includes receiving from the AI ​​model ( Figure 2 ,204) responses to AI prompts ( Figure 5 ,538). The response includes instructions ( Figure 5 The method (540) indicates the selected category to which the AI ​​model classifies the target file, and the response also includes an explanation describing the reasoning used by the AI ​​model to classify the target file into the selected category. The selected category is either a malicious or non-malicious category. The method also includes storing the explanation describing the reasoning used by the AI ​​model to classify the target file into the selected category. The method also includes performing (540) based at least on the indication that the AI ​​model classifies the target file into the selected category. Figure 2 208) Regarding the safe operation of target files ( Figure 5 ,562).

[0100] (B2) In the example method of B1, the process of enabling the AI ​​model to perform a classification of the target file for maliciousness includes: providing the AI ​​prompt word along with the target file and contextual information about the target file as input to the AI ​​model, wherein the contextual information includes at least one of the following: an indication of the location where the target file was downloaded; the process path associated with the target file; the process command line associated with the target file; the parent process command line associated with the target file; or the real-time process name associated with the target file.

[0101] (B3) In any of the example methods in B1-B2, wherein causing the AI ​​model to perform a classification of the target file for maliciousness includes: providing the AI ​​prompt word along with the target file and contextual information about the target file as input to the AI ​​model, wherein the contextual information includes at least one of the following: instructions for instructing a signer to sign the target file; instructions for instructing a publisher to publish the target file; a certificate associated with the target file; at least one of a header byte or a tail byte associated with the target file; or instructions for actions associated with the target file.

[0102] (B4) In any of the example methods in B1-B3, the interpretation in the response to the AI ​​prompt indicates multiple attributes of the target file, which help the AI ​​model select the selected category to which the target file is classified.

[0103] (B5) In any of the example methods in B1-B4, the method further includes: storing classification information in a storage device, wherein the classification information includes: a reference identifier identifying a reference file; reference content of the reference file; a reference AI prompt, the reference AI prompt requesting a classification of the reference file for malice, and the reference AI prompt also requesting a reference explanation for describing the reference reasoning, the reference reasoning being used by the AI ​​model to perform the classification of the reference file; and a reference response to the reference AI prompt, wherein the reference response includes an indication for indicating the reference category to which the reference file is classified, and the reference response also includes a reference explanation for describing the reference reasoning for classifying the reference file into a reference category, wherein the reference category is a malicious category or a non-malicious category; and in response to storing the classification information in the storage device, determining that the target file is to be classified into multiple categories, the multiple categories including malicious and non-malicious categories; wherein causing the AI ​​model to perform the classification of the target file includes: causing the AI ​​model to perform the classification of the target file for malice by providing the AI ​​prompt along with the target file and the classification information to the AI ​​model, and causing the AI ​​model to provide an explanation for describing the reasoning, the reasoning being used by the AI ​​model to perform the classification of the target file.

[0104] (B6) In any of the example methods in B1-B5, the classification information also includes a confidence indicator that indicates the confidence level associated with the classification of the reference document.

[0105] (B7) In the example method of any one of B1-B6, the classification information further includes: a second reference identifier identifying the second reference document; second reference content of the second reference document; a second reference AI prompt, the second reference AI prompt requesting a classification of the second reference document for malice, and the second reference AI prompt also requesting a second reference explanation for describing the second reference reasoning, the second reference reasoning being used by an AI model to perform the classification of the second reference document; and a second reference response to the second reference AI prompt; and wherein the second reference response includes an indication for indicating the second reference category to which the second reference document is classified, and the second reference response further includes a second reference explanation for describing the second reference reasoning for classifying the second reference document into a second reference category, wherein the second reference category is a malicious category or a non-malicious category.

[0106] (B8) In any of the example methods in B1-B7, the method further includes: generating a target vector based at least on an identifier identifying the target file, the content of the target file, and an AI prompt; determining the degree to which a historical vector corresponds to the target vector by comparing the target vector with historical vectors associated with historical files, the historical files being previously classified by an AI model, wherein the historical vector is based at least on: an identifier identifying the historical file; the content of the historical file; and an AI prompt, the AI ​​prompt on which the historical vector is based requesting a classification of the historical file for malicious intent, and the AI ​​prompt also requesting an explanation to describe the reasoning used by the AI ​​model to perform the classification; and selecting a first historical vector from the historical vectors based at least on the degree to which the first historical vector corresponds to the target vector being greater than or equal to a degree threshold; wherein enabling the AI ​​model to perform the classification of the target file includes: enabling the AI ​​model to perform the classification by providing the AI ​​prompt along with the target file and classification information to the AI ​​model. The system categorizes a target file for malicious intent and enables an AI model to provide an explanation describing the reasoning used by the AI ​​model to perform the classification of the target file. The classification information includes: a first identifier that identifies a first historical file within a history file, the first historical file being associated with a first history vector; a first content of the first historical file; a first AI prompt that requests the classification of the first historical file for malicious intent, and the first AI prompt also requests a first explanation describing the first reasoning used by the AI ​​model to perform the classification of the first historical file; and a first response from the AI ​​model to the first AI prompt, wherein the first response includes an indication that instructs the AI ​​model to classify the first historical file into a first category, and the first response also includes a first explanation describing the first reasoning used by the AI ​​model to perform the classification of the first historical file, wherein the first category is either a malicious category or a non-malicious category.

[0107] (B9) In any of the example methods in B1-B8, the history vector is further based on at least a confidence level associated with a classification of the history file for malice; and the selection of a first history vector from the history vector comprises: selecting a first history vector from the history vector based at least on the degree to which the first history vector corresponds to the target vector being greater than or equal to a degree threshold, and at least also based on the first confidence level being greater than or equal to a confidence threshold, wherein the first confidence level is associated with a first classification of the first history file for malice.

[0108] (B10) In any of the example methods in B1-B9, the history vector is further based on at least a confidence level associated with a classification of the history file for malice; and the classification information further includes a first confidence indicator indicating a first confidence level in the confidence level associated with a first classification of the first history file for malice.

[0109] (B11) In any of the example methods in B1-B10, the method further includes: selecting a second historical vector from the historical vectors based at least on the fact that the degree to which the second historical vector corresponds to the target vector is greater than or equal to a degree threshold, wherein the classification information further includes: a second identifier that identifies a second historical file in the historical files, the second historical file being associated with the second historical vector; a second content of the second historical file; a second AI prompt that requests a classification of the second historical file for maliciousness, and the second AI prompt also requests a second explanation for describing a second inference, the second inference being used by the AI ​​model to perform the classification of the second historical file; and a second response from the AI ​​model to the second AI prompt, wherein the second response includes an indication that instructs the AI ​​model to classify the second historical file into a second category, and the second response also includes a second explanation for describing the second inference, the second inference being used by the AI ​​model to perform the classification of the second historical file, wherein the second category is a malicious category or a non-malicious category.

[0110] (B12) In any of the example methods of B1-B11, wherein the first response indicates that the first historical file is classified into a malicious category; wherein the second response indicates that the second historical file is classified into a non-malicious category; and wherein providing the AI ​​prompt word together with the target file and classification information to the AI ​​model includes: at least based on the first response indicating that the first historical file is classified into a malicious category and at least also based on the second response indicating that the second historical file is classified into a non-malicious category, causing the AI ​​model to process the first historical file before processing the second historical file.

[0111] (B13) In any of the example methods in B1-B12, wherein the first response indicates that the first historical file is classified into a non-malicious category; wherein the second response indicates that the second historical file is classified into a malicious category; and wherein providing the AI ​​prompt word along with the target file and classification information to the AI ​​model includes: at least based on the first response indicating that the first historical file is classified into a non-malicious category and at least also based on the second response indicating that the second historical file is classified into a malicious category, causing the AI ​​model to process the first historical file before processing the second historical file.

[0112] (B14) In any of the example methods in B1-B13, the method further includes: generating a target vector based at least on an identifier identifying the target file, the content of the target file, and AI prompts; determining the degree to which a historical vector corresponds to the target vector by comparing the target vector with historical vectors associated with historical files, the historical files previously classified by an AI model, wherein the historical vectors are based at least on: an identifier identifying the historical file; the content of the historical file; and AI prompts, the AI ​​prompts on which the historical vectors are based requesting a classification of the historical file for maliciousness, and the AI ​​prompts on which the historical vectors are based also requesting an explanation for describing the reasoning used by the AI ​​model to perform the classification; selecting N first historical vectors and N second historical vectors from the historical vectors to provide 2N sample historical vectors based at least on the degree to which N first historical vectors and N second historical vectors correspond to the target vector being greater than or equal to a degree threshold, the N first historical vectors being associated with historical files classified as malicious, and the N second historical vectors being associated with historical files classified as non-malicious, where N is a positive integer; and selecting P sample historical vectors from the 2N sample historical vectors. , where P is a positive integer less than 2N; wherein enabling the AI ​​model to perform the classification of target files includes: providing the AI ​​model with AI prompts along with the target files and classification information, enabling the AI ​​model to perform the classification of the target files for maliciousness, and enabling the AI ​​model to provide an explanation describing the reasoning used by the AI ​​model to perform the classification of the target files for maliciousness, wherein the classification information includes: P identifiers, the P identifiers identifying P historical files in the history files, the P historical files being associated with P sample history vectors; the content of the P historical files; P AI prompts, the P AI prompts requesting the classification of the P historical files for maliciousness, and the P AI prompts also requesting an explanation describing the reasoning used by the AI ​​model to perform the classification of the P historical files; and P responses from the AI ​​model to the P AI prompts, wherein the P responses include indications indicating to the AI ​​model to classify the P historical files into a selected category, and the P responses also include an explanation describing the reasoning used by the AI ​​model to perform the classification of the P historical files, wherein the selected category is a malicious category or a non-malicious category.

[0113] (B15) In any of the example methods in B1-B14, the method of causing the AI ​​model to perform classification of the target file and provide an explanation includes: causing the AI ​​model to perform classification of the target file for maliciousness, providing an explanation, and providing an indication of confidence level associated with the classification of the target file; wherein the AI ​​prompt further requests an indication of confidence level associated with the classification of the target file; wherein the response further includes an indication of confidence level associated with classifying the target file into a selected category; and wherein the method further includes: providing an indication of confidence level to a user via a user interface associated with classifying the target file into a selected category.

[0114] (C1) An example computer program product ( Figure 6 (618, 622), including a computer-readable storage medium on which instructions are recorded, the instructions causing a processor-based system ( Figure 1 102A-102M, 106A-106N; Figure 5 500; Figure 6 (600) can perform operations. Operations include enabling ( Figure 2 ,202) AI model ( Figure 5 ,514) will target file ( Figure 5 (536) are classified into malicious or non-malicious categories, and the AI ​​model provides an explanation. Figure 5 ,542), Explaining the reasoning process, which is used by the AI ​​model to select whether a target file should be classified as malicious or non-malicious, and enabling the AI ​​model to provide an indication of confidence level, which is associated with classifying the target file as malicious or non-malicious, by using AI prompt words ( Figure 5 The AI ​​prompt (558) is provided as input to the AI ​​model along with the target file. The AI ​​prompt requests the AI ​​model to choose between a malicious and a non-malicious category to which the target file should be classified, and also requests an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category. It also requests an indication of the confidence level associated with classifying the target file as malicious or non-malicious. The target file includes context about the AI ​​prompt. The operation also includes receiving (558) from the AI ​​model. Figure 2 ,204) responses to AI prompts ( Figure 5 ,538). The response includes instructions ( Figure 5The response also includes an explanation describing the reasoning used by the AI ​​model to select the target file's category, and an indication of the confidence level associated with classifying the target file into the selected category. The selected category is either malicious or non-malicious. The operation also includes providing the user with ( ) via a user interface. Figure 2 (206) Explanation and indication of confidence levels, the explanation describing the reasoning used by the AI ​​model to select the chosen category to which the target file is classified, and the confidence level being associated with classifying the target file into the chosen category. The operation also includes performing (…) based at least on the indication of the chosen category to which the target file is classified by the AI ​​model. Figure 2 208) Regarding the safe operation of target files ( Figure 5 ,562).

[0115] III. Example Computer System Figure 6 An example computer 600 in which various embodiments can be implemented is shown. Figure 1 Any one or more user equipments among the user equipments 102A-102M shown, Figure 1 Any one or more of the servers 106A-106N shown and / or Figure 5 The computing system 500 shown can be implemented using a computer 600, including employing one or more features and / or alternative features of computer 600. For example, computer 600 can be a general-purpose computing device in the form of a conventional personal computer, mobile computer, or workstation, or computer 600 can be a dedicated computing device. The description of computer 600 herein is for illustrative purposes only and is not intended to be limiting. As those skilled in the art will recognize, the embodiments can be implemented in other types of computer systems.

[0116] like Figure 6 As shown, computer 600 includes a processor system 602, system memory 604, and a bus 606 coupling various system components, including system memory 604, to the processor system 602. Bus 606 represents any one or more of several types of bus architectures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor bus or local bus employing any of various bus architectures. System memory 604 includes read-only memory (ROM) 608 and random access memory (RAM) 610. Basic input / output system 612 (BIOS) is stored in ROM 608.

[0117] Computer 600 also includes one or more of the following drives: a hard disk drive 614 for reading and writing to a hard disk, a disk drive 616 for reading and writing to a removable disk 618, and an optical disc drive 620 for reading and writing to a removable optical disc 622 such as a CD-ROM, DVD-ROM, or other optical media. Hard disk drive 614, disk drive 616, and optical disc drive 620 are connected to bus 606 via hard disk drive interface 624, disk drive interface 626, and optical disc drive interface 628, respectively. The drives and their associated computer-readable storage media provide the computer with non-volatile storage of computer-readable instructions, data structures, program modules, and other data. Although hard disks, removable disks, and removable optical discs have been described, other types of computer-readable storage media, such as flash memory cards, digital video discs, random access memory (RAM), and read-only memory (ROM), can be used to store data.

[0118] Multiple program modules may be stored on a hard disk, magnetic disk, optical disk, ROM, or RAM. These programs include an operating system 630, one or more application programs 632, other program modules 634, and program data 636. Application program 632 or program module 634 may include, for example, computer program logic for implementing, as described herein, AI-based classification interpretation logic 108, AI-based classification interpretation logic 508, storage device 510, control logic 512, AI model 514, action logic 516, static example logic 518, dynamic example logic 520, interpretation logic 522, security logic 524, storage logic 526, classification determination logic 528, vector generation logic 530, correspondence determination logic 532, vector selection logic 534, flowchart 200 (including any step of flowchart 200), flowchart 300 (including any step of flowchart 300), and / or flowchart 400 (including any step of flowchart 400).

[0119] Users can input commands and information into computer 600 through input devices such as keyboard 638 and pointing device 640. Other input devices (not shown) may include microphones, joysticks, game controllers, satellite antennas, scanners, touchscreens, cameras, accelerometers, gyroscopes, etc. These and other input devices are typically connected to processor system 602 via serial port interface 642 coupled to bus 606, but may also be connected via other interfaces such as parallel ports, game ports, or universal serial buses (USB).

[0120] Display device 644 (e.g., a monitor) is also connected to bus 606 via an interface such as video adapter 646. In addition to display device 644, computer 600 may include other peripheral output devices (not shown), such as speakers and printers.

[0121] Computer 600 is connected to network 648 (e.g., the Internet) via a network interface or adapter 650, modem 652, or other components for establishing communication over the network. Modem 652 may be internal or external and is connected to bus 606 via serial port interface 642.

[0122] As used herein, the terms "computer program medium" and "computer-readable storage medium" generally refer to media (e.g., non-transitory media) such as: a hard disk associated with hard disk drive 614, a removable disk drive 618, a removable optical disk drive 622, and other media such as flash memory cards, digital video disks, random access memory (RAM), read-only memory (ROM), etc. Computer-readable storage media are not signals such as carrier signals or propagation signals. For example, computer-readable storage media may not include signals. Therefore, computer-readable storage media themselves do not constitute signals. These computer-readable storage media are distinct from and do not overlap with communication media (i.e., they do not include communication media). Communication media carry computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves. The term "modulated data signal" refers to a signal whose one or more characteristics are set or altered in a manner that encodes information into the signal. By way of example and not limitation, communication media include wireless media such as acoustic media, RF media, infrared media, and other wireless media, as well as wired media. Example embodiments also relate to such communication media.

[0123] As described above, computer programs and modules (including application program 632 and other program modules 634) can be stored on a hard disk, magnetic disk, optical disk, ROM, or RAM. Such computer programs can also be received via network interface 650 or serial port interface 642. When executed or loaded by an application, such computer programs enable computer 600 to implement the features of the embodiments discussed herein. Therefore, such computer programs represent the controller of computer 600.

[0124] The example embodiments also relate to computer program products comprising software (e.g., computer-readable instructions) stored on any computer-usable medium. When executed in one or more data processing devices, such software causes the data processing devices to operate as described herein. The embodiments may employ any computer-usable or computer-readable medium currently known or developed in the future. Examples of computer-readable media include, but are not limited to, storage devices such as RAM, hard disk drives, floppy disks, CD-ROMs, DVD-ROMs, zip discs, magnetic tapes, magnetic storage devices, optical storage devices, MEMS-based storage devices, and nanotechnology-based storage devices.

[0125] It should be understood that the disclosed technology is not limited to any particular type of computer or hardware. Certain details of suitable computers and hardware are well known in the art and do not need to be elaborated in this disclosure.

[0126] IV. Conclusion The foregoing detailed embodiments have been illustrated with reference to the accompanying drawings, which show exemplary embodiments of the present invention. However, the scope of the present invention is not limited to these embodiments, but is defined by the appended claims. Therefore, embodiments other than those shown in the drawings (e.g., modifications of the shown embodiments) may still be covered by the present invention.

[0127] References to "an embodiment," "embodiment," "example embodiment," etc., in this specification indicate that the described embodiment may include a specific feature, structure, or characteristic, but not every embodiment necessarily includes that specific feature, structure, or characteristic. Furthermore, these phrases do not necessarily refer to the same embodiment. Additionally, when a specific feature, structure, or characteristic is described in connection with an embodiment, those skilled in the art can implement that feature, structure, or characteristic in conjunction with other embodiments, whether explicitly described or not.

[0128] Descriptors such as “first,” “second,” and “third” are used to refer to certain elements discussed herein. These descriptors are used to facilitate discussion of example embodiments and do not imply that the elements referred to have a required order unless expressly stated herein.

[0129] Although the subject matter has been described in language specific to structural features and / or actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are disclosed as examples of implementing the claims, and other equivalent features and actions are intended to fall within the scope of the claims.

Claims

1. A system (102A-102M, 106A-106N, 500, 600), comprising: Processor system (602); as well as Memory (604, 608, 610) stores computer-executable instructions, which are executable by the processor system (602) to at least: By providing the AI ​​prompt (558) along with the target file (536) as input to the AI ​​model (514), (202) the AI ​​model (514) classifies the target file (536) into a malicious or non-malicious category, and the AI ​​model provides an explanation (542) for describing the reasoning used by the AI ​​model (514) to select the malicious or non-malicious category to which the target file (536) should be classified, the AI ​​prompt (558) requests the AI ​​model (514) to select between the malicious and non-malicious categories to which the target file (536) should be classified, and also requests the explanation (542) for describing the reasoning used by the AI ​​model (514) to select the malicious or non-malicious category to which the target file (536) should be classified, wherein the target file (536) includes context about the AI ​​prompt (558); The AI ​​model (514) receives (204) a response (538) to the AI ​​prompt (558), the response (538) including an indication (540) for instructing the AI ​​model (514) to classify the target file (536) into a selected category, and the response (538) also includes an explanation (542) for describing the reasoning used by the AI ​​model (514) to select the selected category to which the target file (536) is classified, wherein the selected category is the malicious category or the non-malicious category; The explanation (542) described by the AI ​​model (514) is provided to the user via the user interface (206), the explanation (542) describing the reasoning used by the AI ​​model (514) to select the selected category to which the target file (536) is classified; as well as At least based on the indication (540) of the selected category into which the target file (536) is classified by the AI ​​model (514), a security operation (562) is performed on the target file (536).

2. The system of claim 1, wherein the computer-executable instructions are executable by the processor system to at least: By providing the AI ​​suggestion words, along with the target file and contextual information about the target file, as input to the AI ​​model, the AI ​​model classifies the target file into either the malicious category or the non-malicious category; and The context information includes at least one of the following: An indication of the location where the target file was downloaded; The process path associated with the target file; The process command line associated with the target file; The parent process command line associated with the target file; or The name of the real-time process associated with the target file.

3. The system of claim 1, wherein the interpretation in the response to the AI ​​prompt indicates multiple attributes of the target file, the multiple attributes helping the AI ​​model to select the selected category to which the target file (536) is classified.

4. The system of claim 1, wherein the computer-executable instructions are executable by the processor system to at least: The classification information is stored in a storage device. The classification information includes: Reference identifier for referenced documents; The reference content of the reference document; The reference AI prompt, which requests the AI ​​model to select between the malicious and non-malicious categories to which the reference document is to be classified, and further requests a reference explanation describing the reference reasoning used by the AI ​​model to select the malicious or non-malicious category to which the reference document is to be classified; and a reference response to the reference AI prompt. The reference response includes an indication to indicate the reference category to which the reference file is classified, and the reference response also includes a reference interpretation describing the reference reasoning used to classify the reference file into the reference category, wherein the reference category is the malicious category or the non-malicious category; In response to the classification information being stored in the storage device, it is determined that the target file should be classified into multiple categories, including the malicious category and the non-malicious category; as well as By providing the AI ​​prompt along with the target file and the classification information to the AI ​​model, the AI ​​model classifies the target file into the malicious category or the non-malicious category, and provides an explanation describing the reasoning used by the AI ​​model to select the malicious category or the non-malicious category to which the target file should be classified.

5. The system of claim 4, wherein the classification information further includes a confidence indicator indicating a confidence level associated with classifying the reference document into the malicious category or the non-malicious category.

6. The system according to claim 4, wherein the classification information further includes: A second reference identifier that identifies the second reference document; The second reference content of the second reference document; The second reference AI prompt requests the AI ​​model to select between the malicious category and the non-malicious category to which the second reference document is to be classified, and the second reference AI prompt also requests a second reference interpretation for describing the second reference reasoning used by the AI ​​model to select the malicious category or the non-malicious category to which the second reference document is to be classified; and a second reference response to the second reference AI prompt; and The second reference response includes an indication to indicate a second reference category to which the second reference document is classified, and the second reference response also includes a second reference interpretation to describe the second reference reasoning used to classify the second reference document into the second reference category, wherein the second reference category is the malicious category or the non-malicious category.

7. The system of claim 1, wherein the computer-executable instructions are executable by the processor system to at least: A target vector is generated based at least on the identifier that identifies the target file, the content of the target file, and the AI ​​prompt words; The degree to which the historical vector corresponds to the target vector is determined by comparing the target vector with a historical vector associated with a historical file previously classified by the AI ​​model. The historical vector is based at least on: an identifier identifying the historical file; the content of the historical file; and an AI prompt, the AI ​​prompt requesting the AI ​​model to select between a malicious category and a non-malicious category to which the historical file is to be classified. The AI ​​prompt also requests an explanation describing the reasoning used by the AI ​​model to select either the malicious category or the non-malicious category to which the historical file is to be classified. The first historical vector is selected from the historical vectors based at least on the fact that the degree to which the first historical vector corresponds to the target vector is greater than or equal to a degree threshold; and By providing the AI ​​prompt along with the target file and classification information to the AI ​​model, the AI ​​model classifies the target file into the malicious category or the non-malicious category, and provides an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The classification information includes: A first identifier, identifying a first historical file in the history files, the first historical file being associated with a first history vector; a first content of the first historical file; a first AI prompt, requesting the AI ​​model to select between the malicious category and the non-malicious category to which the first historical file should be classified, and the first AI prompt also requesting a first explanation for describing a first inference used by the AI ​​model to select the malicious category or the non-malicious category to which the first historical file should be classified; and a first response from the AI ​​model to the first AI prompt. The first response includes an indication for instructing the AI ​​model to classify the first historical file into a first category, and the first response also includes a first explanation for describing the first reasoning used by the AI ​​model to select the first category to which the first historical file is classified, wherein the first category is the malicious category or the non-malicious category.

8. The system of claim 7, wherein the history vector is further based at least on a confidence level associated with classifying the history file into the malicious category or the non-malicious category; and The classification information further includes a first confidence indicator, which indicates a first confidence level in the confidence level, and the first confidence level is associated with a first classification that categorizes the first historical file into the malicious category or the non-malicious category.

9. The system of claim 7, wherein the computer-executable instructions are executable by the processor system to at least: The second historical vector is selected from the historical vectors based on at least the fact that the degree to which the second historical vector corresponds to the target vector is greater than or equal to the degree threshold. The classification information includes: A second identifier, identifying a second historical file within the historical files, the second historical file being associated with a second historical vector; second content of the second historical file; a second AI prompt, requesting the AI ​​model to select between the malicious category and the non-malicious category to which the second historical file should be classified, and the second AI prompt also requesting a second explanation for describing a second inference used by the AI ​​model to select the malicious category or the non-malicious category to which the second historical file should be classified; and a second response from the AI ​​model to the second AI prompt. The second response includes an indication for instructing the AI ​​model to classify the second historical file into a second category, and the second response also includes a second explanation for describing the second reasoning used by the AI ​​model to select the second category to which the second historical file is classified, wherein the second category is the malicious category or the non-malicious category.

10. The system of claim 1, wherein the computer-executable instructions are executable by the processor system to at least: A target vector is generated based at least on the identifier that identifies the target file, the content of the target file, and the AI ​​prompt words; The degree to which the historical vector corresponds to the target vector is determined by comparing the target vector with historical vectors associated with historical files previously classified by the AI ​​model. The historical vectors are based at least on: an identifier identifying the historical file; the content of the historical file; and an AI prompt that requests the AI ​​model to choose between a malicious category and a non-malicious category to which the historical file should be classified. The AI ​​prompt also requests an explanation describing the reasoning used by the AI ​​model to select either the malicious or non-malicious category to which the historical file should be classified. Based on at least N first historical vectors and N second historical vectors corresponding to the target vector to a degree greater than or equal to a degree threshold, the N first historical vectors and the N second historical vectors are selected from the historical vectors to provide 2N sample historical vectors, wherein the N first historical vectors are associated with historical files classified into the malicious category, and the N second historical vectors are associated with historical files classified into the non-malicious category, where N is a positive integer; Select P sample history vectors from the 2N sample history vectors, where P is a positive integer less than 2N; as well as By providing the AI ​​prompt along with the target file and classification information to the AI ​​model, the AI ​​model classifies the target file into the malicious category or the non-malicious category, and provides an explanation describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the target file should be classified. The classification information includes: P identifiers, which identify P historical files in the historical files, and the P historical files are associated with the P sample historical vectors; and the content of the P historical files; P AI prompts, wherein the P AI prompts request the AI ​​model to select between the malicious and non-malicious categories to which the P historical files are to be classified, and the P AI prompts also request explanations for describing the reasoning used by the AI ​​model to select the malicious or non-malicious category to which the P historical files are to be classified; and P responses from the AI ​​model to the P AI prompts, and The P responses include an indication for the AI ​​model to classify the P historical files into a selected category, and the P responses also include an explanation describing the reasoning used by the AI ​​model to select the selected category into which the P historical files are classified, wherein the selected category is the malicious category or the non-malicious category.

11. The system of claim 1, wherein the computer-executable instructions are executable by the processor system to at least: The AI ​​model classifies the target file, provides the explanation, and provides an indication of confidence level, which is associated with classifying the target file into the malicious category or the non-malicious category. The AI ​​prompt also requests the indication of the confidence level, which is associated with classifying the target file into the malicious or non-malicious category. The response further includes the indication of the confidence level, which is associated with classifying the target file into the selected category; and The user interface provides the user with an indication of the confidence level, which is associated with classifying the target file into the selected category.

12. A method implemented by a computing system (102A-102M, 106A-106N, 500, 600), the method comprising: By providing the AI ​​prompt word (558) along with the target file (536) as input to the AI ​​model (514), the AI ​​model (514) (202) performs a classification of the target file (536) for malice, and the AI ​​model (514) (202) provides an explanation (542) describing the reasoning used by the AI ​​model (514) to perform the classification, the AI ​​prompt word (558) requesting the classification of the target file (536), and also requesting the explanation (542), wherein the target file (536) includes context about the AI ​​prompt word (558); The AI ​​model (514) receives (204) a response (538) to the AI ​​prompt (558), the response (538) including an indication (540) for indicating the selected category to which the AI ​​model (514) classifies the target file (536), and the response (538) also includes an explanation (542) for describing the reasoning used by the AI ​​model (514) to classify the target file (536) into the selected category, wherein the selected category is the malicious category or the non-malicious category; Store (206) the explanation (542), the explanation (542) describing the reasoning, the reasoning being used by the AI ​​model to classify the target file (536) into the selected category; as well as At least based on the instruction (540), perform (208) a security operation (562) on the target file (536), the instruction (540) being used to instruct the AI ​​model (514) to classify the target file (536) into the selected category.

13. The method of claim 12, wherein causing the AI ​​model to perform the classification of the target file (536) for malice comprises: The AI ​​prompts, along with the target file and contextual information about the target file, are provided as input to the AI ​​model, wherein the contextual information includes at least one of the following: Used to indicate the signer's instructions, the signer signing the target file; Used to indicate the publisher's instructions, who publishes the target file; The certificate associated with the target file; At least one of the header bytes or the tail bytes associated with the target file; or Instructions for the behavior associated with the target file.

14. The method of claim 12, further comprising: The classification information is stored in a storage device. The classification information includes: a reference identifier that identifies the reference document; the reference content of the reference document; a reference AI prompt word that requests a classification of the reference document for malicious intent, and the reference AI prompt word also requests a reference interpretation to describe the reference reasoning used by the AI ​​model to perform the classification of the reference document; and a reference response to the reference AI prompt word. The reference response includes an indication indicating the reference category to which the reference document is classified, and the reference response further includes a reference interpretation describing the reference reasoning used to classify the reference document into the reference category, wherein the reference category is the malicious category or the non-malicious category; and In response to storing the classification information in the storage device, it is determined that the target file should be classified into multiple categories, including the malicious category and the non-malicious category; The process of enabling the AI ​​model to perform the classification of the target file includes: By providing the AI ​​prompt words along with the target file and the classification information to the AI ​​model, the AI ​​model performs the classification of the target file for maliciousness, and provides an explanation describing the reasoning used by the AI ​​model to perform the classification of the target file.

15. The method of claim 12, further comprising: A target vector is generated based at least on the identifier that identifies the target file, the content of the target file, and the AI ​​prompt words; The degree to which the historical vector corresponds to the target vector is determined by comparing the target vector with historical vectors associated with historical files previously classified by the AI ​​model. The historical vectors are based on at least: an identifier identifying the historical file; the content of the historical file; and AI prompts that request the historical file to be classified as malicious, and the AI ​​prompts also request an explanation describing the reasoning used by the AI ​​model to perform the classification. The first historical vector is selected from the historical vectors based on at least the fact that the degree to which the first historical vector corresponds to the target vector is greater than or equal to a degree threshold. The process of enabling the AI ​​model to perform the classification of the target file includes: By providing the AI ​​prompts along with the target file and classification information to the AI ​​model, the AI ​​model performs the classification of the target file for malicious intent, and provides an explanation describing the reasoning used by the AI ​​model to perform the classification of the target file. The classification information includes: a first identifier that identifies a first historical file in the history files, the first historical file being associated with a first history vector; a first content of the first historical file; a first AI prompt that requests a classification of the first historical file for malicious intent, and the first AI prompt also requests a first interpretation to describe a first inference, the first inference being used by the AI ​​model to perform the classification of the first historical file; and a first response from the AI ​​model to the first AI prompt. The first response includes an indication for instructing the AI ​​model to classify the first historical file into a first category, and the first response also includes a first explanation for describing the first reasoning used by the AI ​​model to perform the classification of the first historical file, wherein the first category is the malicious category or the non-malicious category.

16. The method of claim 15, further comprising: The second historical vector is selected from the historical vectors based on at least the fact that the degree to which the second historical vector corresponds to the target vector is greater than or equal to the degree threshold. The classification information includes: a second identifier identifying a second historical file within the historical files, the second historical file being associated with a second historical vector; second content of the second historical file; a second AI prompt requesting a classification of the second historical file for malicious intent, and the second AI prompt also requesting a second interpretation to describe a second inference used by the AI ​​model to perform the classification of the second historical file; and a second response from the AI ​​model to the second AI prompt. The second response includes an indication for instructing the AI ​​model to classify the second historical file into a second category, and the second response also includes a second explanation for describing the second reasoning used by the AI ​​model to perform the classification of the second historical file, wherein the second category is the malicious category or the non-malicious category.

17. The method of claim 16, wherein the first response indicates that the first history file is classified into the malicious category; The second response indicates that the second historical file is classified into the non-malicious category; and The process of providing the AI ​​prompt words, along with the target file and the classification information, to the AI ​​model includes: The AI ​​model processes the first historical file before processing the second historical file, based at least on the first response indicating that the first historical file is classified into the malicious category and at least also on the second response indicating that the second historical file is classified into the non-malicious category.

18. The method of claim 16, wherein the first response indicates that the first history file is classified into the non-malicious category; The second response indicates that the second historical file is classified into the malicious category; and The process of providing the AI ​​prompt words, along with the target file and the classification information, to the AI ​​model includes: The AI ​​model processes the first historical file before processing the second historical file, based at least on the first response indicating that the first historical file is classified into the non-malicious category and at least also on the second response indicating that the second historical file is classified into the malicious category.

19. The method of claim 12, further comprising: A target vector is generated based at least on the identifier that identifies the target file, the content of the target file, and the AI ​​prompt words; The degree to which the historical vector corresponds to the target vector is determined by comparing the target vector with a historical vector associated with a historical file previously classified by the AI ​​model. The historical vector is based on at least: an identifier identifying the historical file; the content of the historical file; and an AI prompt word on which the historical vector is based, requesting a classification of the historical file for malicious intent. The AI ​​prompt word also requests an explanation describing the reasoning used by the AI ​​model to perform the classification of the historical file. Based on at least N first historical vectors and N second historical vectors corresponding to the target vector to a degree greater than or equal to a degree threshold, the N first historical vectors and the N second historical vectors are selected from the historical vectors to provide 2N sample historical vectors, wherein the N first historical vectors are associated with historical files classified into the malicious category, and the N second historical vectors are associated with historical files classified into the non-malicious category, where N is a positive integer; Select P sample history vectors from the 2N sample history vectors, where P is a positive integer less than 2N; The process of enabling the AI ​​model to perform the classification of the target file includes: By providing the AI ​​prompts along with the target file and classification information to the AI ​​model, the AI ​​model performs the classification of the target file for malicious intent, and provides an explanation describing the reasoning used by the AI ​​model to perform the classification of the target file for malicious intent. The classification information includes: P identifiers, each identifying one of the P historical files, which are associated with the P sample history vectors; the content of the P historical files; P AI prompts, each requesting a classification of the P historical files for malicious intent, and further requesting an explanation to describe the reasoning used by the AI ​​model to perform the classification of the P historical files; and P responses from the AI ​​model to the P AI prompts. The P responses include an indication for the AI ​​model to classify the P historical files into a selected category, and the P responses also include an explanation describing the reasoning used by the AI ​​model to perform the classification of the P historical files, wherein the selected category is the malicious category or the non-malicious category.

20. A computer program product (618, 622) comprising a computer-readable storage medium having instructions recorded thereon, the instructions enabling a processor-based system (102A-102M, 106A-106N, 500, 600) to perform operations, the operations including: By providing the AI ​​prompt word (558) along with the target file (536) as input to the AI ​​model (514), the AI ​​model (514) (202) classifies the target file (536) into a malicious or non-malicious category, and provides an explanation (542) for describing the reasoning used by the AI ​​model (514) to select the malicious or non-malicious category to which the target file (536) should be classified, and the AI ​​model (514) provides an indication of confidence level associated with classifying the target file (536) into the malicious or non-malicious category, the AI ​​prompt word (558) The AI ​​prompt (558) requests the AI ​​model (514) to select between the malicious category and the non-malicious category to which the target file (536) is to be classified, and the AI ​​prompt (558) also requests the explanation (542) for describing the reasoning used by the AI ​​model (514) to select the malicious category or the non-malicious category to which the target file (536) is to be classified, and the AI ​​prompt (558) also requests the indication of the confidence level associated with classifying the target file (536) into the malicious category or the non-malicious category, wherein the target file (536) includes the context of the AI ​​prompt (558); The AI ​​model (514) receives (204) a response (538) to the AI ​​prompt (558), the response (538) including an indication (540) for indicating the selected category to which the AI ​​model (514) classifies the target file (536), and the response (538) also includes an explanation (542) for describing the reasoning used by the AI ​​model (514) to select the selected category to which the target file (536) is classified, and the response (538) also includes the indication of the confidence level associated with classifying the target file (536) into the selected category, wherein the selected category is the malicious category or the non-malicious category; The explanation (542) and the indication of the confidence level are provided to the user via a user interface (206), the explanation (542) describing the reasoning used by the AI ​​model (514) to select the selected category to which the target file (536) is classified, and the confidence level is associated with classifying the target file (536) into the selected category; and At least based on the instruction (540), perform a security operation (562) on the target file (536), the instruction (540) being used to instruct the AI ​​model (514) to classify the target file (536) into the selected category.

Images